e275e8febf42d63d37ded05b4e6aacc1b36b9ace6318cd09d65b822037464c37

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/PassGuardX64ForYBXY/PassGuardX64.dll
Size

3.3MB
MD5

c51656b26119aacd1a46c0e0a595a39c
SHA1

b75d8b77297d2fd7f6f7763a3d50ea06beb396e6
SHA256

665e7de614a196741af1a52b48f91453136d0bce3e0048699b3b115e3c7078b9
SHA512

a2a3747dc518249599097bec700cb09b1551b6d9052d0225f5e4abf2d458acff6edd4867db81685bb94c71c6dc5302f868be8de170ca6804ab79288c5a5afaf7
SSDEEP

49152:WYbgS0xNu63rtrgwNAOa1qXEeaenHgJEomipl4LgziNXfzEurRnKtAGeXbyg10:WYS5aG7onlw75fzE+RKtALLyy0

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2180	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PassGuardX64.PassGuard.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\TypeLib\ = "{5855696C-0E00-45A5-9588-1B7F2393CA28}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5855696C-0E00-45A5-9588-1B7F2393CA28}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5855696C-0E00-45A5-9588-1B7F2393CA28}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PassGuardX64.PassGuard.1\ = "PassGuardX64 Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PassGuardX64.PassGuard.1\CLSID\ = "{206F48A0-61BB-48C8-B54C-7700B7923CFD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{611F005A-6C87-4065-8DCC-7D124C50CF0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}\ = "_IPassGuardEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}\TypeLib\ = "{5855696C-0E00-45A5-9588-1B7F2393CA28}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PassGuardX64.PassGuard\ = "PassGuardX64 Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5855696C-0E00-45A5-9588-1B7F2393CA28}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\PassGuardX64ForYBXY"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}\ = "IPassGuard"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PassGuardX64.PassGuard\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5855696C-0E00-45A5-9588-1B7F2393CA28}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5855696C-0E00-45A5-9588-1B7F2393CA28}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\PassGuardX64ForYBXY\\PassGuardX64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\Insertable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\PassGuardX64ForYBXY\\PassGuardX64.dll, 106"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PassGuardX64.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}\TypeLib\ = "{5855696C-0E00-45A5-9588-1B7F2393CA28}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PassGuardX64.PassGuard\CurVer\ = ".PassGuard.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5855696C-0E00-45A5-9588-1B7F2393CA28}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}\TypeLib\ = "{5855696C-0E00-45A5-9588-1B7F2393CA28}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PassGuardX64.PassGuard.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\VersionIndependentProgID\ = "PassGuardX64.PassGuard"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}\ = "_IPassGuardEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\ProgID\ = "PassGuardX64.PassGuard.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5855696C-0E00-45A5-9588-1B7F2393CA28}\1.0\ = "PassGuardX64Lib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF78D166-3F47-4915-9C69-C5FAE894E206}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0119C586-16E8-44F3-992C-AF299EBFD614}\TypeLib\ = "{5855696C-0E00-45A5-9588-1B7F2393CA28}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PassGuardX64.PassGuard.1\Insertable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PassGuardX64.PassGuard\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{206F48A0-61BB-48C8-B54C-7700B7923CFD}\ = "PassGuardX64 Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5855696C-0E00-45A5-9588-1B7F2393CA28}\1.0\FLAGS\ = "0"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\PassGuardX64ForYBXY\PassGuardX64.dll
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-2-0x000007FEF6FD1000-0x000007FEF709A000-memory.dmp

Filesize
804KB

Download
memory/2180-3-0x000007FEF6FD0000-0x000007FEF731C000-memory.dmp

Filesize
3.3MB

Download
memory/2180-1-0x000007FEF6FD0000-0x000007FEF731C000-memory.dmp

Filesize
3.3MB

Download
memory/2180-0-0x000007FEF6FD0000-0x000007FEF731C000-memory.dmp

Filesize
3.3MB

Download