282731b2d3212f21d8777946823514a65eeb73e2b5edba9c15f1f101183e98e5

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 09:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

x64/CommonProgramFiles/SpeechEngines/Microsoft/spcommon.dll
Size

106KB
MD5

d5965cd690d4f5b7a79be35d5507f585
SHA1

741aa9431c7417a90d1625b34cd0b78e4e7fa784
SHA256

a0475d7513cba997dcb16cf4a5730e9b5f595a5739c5dd8a7427b4c873695009
SHA512

22e9dd787c4006b8a32a1f1977bb28625d72d1c73592acadf34aa74c1e6f79ea7556eadbae1e073fba4122ab98d8464f51069a3946742039d353cb7f2bc69924
SSDEEP

1536:76QQirIRAzZ4UsgoWw6Co9MaQL4jrB7LL5uqaSS5Wm7b0:76Qr0aZtsg6TJ8jrB7LL5bgWm7

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 32 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SAPI.LTSLexicon.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9153CE57-F693-4A8E-8B7C-29C8486566D0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SAPI.LTSLexicon.1\ = "LTS Lexicon Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SAPI.LTSLexicon	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SAPI.LTSLexicon\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SAPI.LTSLexicon.1\CLSID\ = "{685879BA-3263-11D3-9C26-00C04F8EF87C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x64\\CommonProgramFiles\\SpeechEngines\\Microsoft\\spcommon.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}\TypeLib\ = "{410B4FEB-339A-11D2-9602-00C04F8EE628}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9153CE57-F693-4A8E-8B7C-29C8486566D0}\1.0\ = "Microsoft LTScommon Object Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}\VersionIndependentProgID\ = "SAPI.LTSLexicon"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9153CE57-F693-4A8E-8B7C-29C8486566D0}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SAPI.LTSLexicon.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SAPI.LTSLexicon\ = "LTS Lexicon Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9153CE57-F693-4A8E-8B7C-29C8486566D0}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x64\\CommonProgramFiles\\SpeechEngines\\Microsoft\\spcommon.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9153CE57-F693-4A8E-8B7C-29C8486566D0}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SAPI.LTSLexicon\CLSID\ = "{685879BA-3263-11D3-9C26-00C04F8EF87C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SAPI.LTSLexicon\CurVer\ = "SAPI.LTSLexicon.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}\ProgID\ = "SAPI.LTSLexicon.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9153CE57-F693-4A8E-8B7C-29C8486566D0}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9153CE57-F693-4A8E-8B7C-29C8486566D0}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9153CE57-F693-4A8E-8B7C-29C8486566D0}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9153CE57-F693-4A8E-8B7C-29C8486566D0}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x64\\CommonProgramFiles\\SpeechEngines\\Microsoft\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SAPI.LTSLexicon\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{685879BA-3263-11D3-9C26-00C04F8EF87C}\ = "LTS Lexicon Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9153CE57-F693-4A8E-8B7C-29C8486566D0}\1.0\FLAGS	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\x64\CommonProgramFiles\SpeechEngines\Microsoft\spcommon.dll
1⤵
- Modifies registry class
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads