ff9f6ed7a1f136b3cb401865bfa54a87e4bd9415409ab7b4d344c89681a7f95d

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff9f6ed7a1f136b3cb401865bfa54a87e4bd9415409ab7b4d344c89681a7f95d.dll
Size

293KB
MD5

7bb99d71c60fc6d11195df6272bc2646
SHA1

73af7ac0b54d46e63f5cd82e640a38f2e1315488
SHA256

ff9f6ed7a1f136b3cb401865bfa54a87e4bd9415409ab7b4d344c89681a7f95d
SHA512

11cc6c5a9cc3850af15bb6781a5dd30a08e57b21088e5964e682f549e1773690a3a169a5bf62bab94b6a47c91d56dbfb3cbec35e25aaeb39b2721c50d9991655
SSDEEP

6144:JtWFdmV8fpt2Qe+tyeSwe0tdYI1H/F8c4PW24F:rqmV8BMbD3weIDfGnPaF

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4E15CD0-F916-4C8E-830A-15E3E9D01A1B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67FB8D5D-AD60-48E4-9E02-BAADD20D1DB1}\TypeLib\ = "{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4E15CD0-F916-4C8E-830A-15E3E9D01A1B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ff9f6ed7a1f136b3cb401865bfa54a87e4bd9415409ab7b4d344c89681a7f95d.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ff9f6ed7a1f136b3cb401865bfa54a87e4bd9415409ab7b4d344c89681a7f95d.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\TypeLib\ = "{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}\1.0\ = "XDShellExtHelperLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67FB8D5D-AD60-48E4-9E02-BAADD20D1DB1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ff9f6ed7a1f136b3cb401865bfa54a87e4bd9415409ab7b4d344c89681a7f95d.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67FB8D5D-AD60-48E4-9E02-BAADD20D1DB1}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4E15CD0-F916-4C8E-830A-15E3E9D01A1B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67FB8D5D-AD60-48E4-9E02-BAADD20D1DB1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4E15CD0-F916-4C8E-830A-15E3E9D01A1B}\ = "ShellContextMenu Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4E15CD0-F916-4C8E-830A-15E3E9D01A1B}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\TypeLib\ = "{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67FB8D5D-AD60-48E4-9E02-BAADD20D1DB1}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67FB8D5D-AD60-48E4-9E02-BAADD20D1DB1}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\1XdShellExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\ = "IShellContextMenu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67FB8D5D-AD60-48E4-9E02-BAADD20D1DB1}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\1XdShellExt\ = "{B4E15CD0-F916-4C8E-830A-15E3E9D01A1B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4E15CD0-F916-4C8E-830A-15E3E9D01A1B}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4E15CD0-F916-4C8E-830A-15E3E9D01A1B}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4E15CD0-F916-4C8E-830A-15E3E9D01A1B}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67FB8D5D-AD60-48E4-9E02-BAADD20D1DB1}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\ = "IShellContextMenu"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4E15CD0-F916-4C8E-830A-15E3E9D01A1B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4E15CD0-F916-4C8E-830A-15E3E9D01A1B}\TypeLib\ = "{74488ED6-7DF3-4D9C-A9A5-60EAAC6437A8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{358AD938-2769-4A12-8551-5948D02ABC7C}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{67FB8D5D-AD60-48E4-9E02-BAADD20D1DB1}\ = "CompReg Class"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ff9f6ed7a1f136b3cb401865bfa54a87e4bd9415409ab7b4d344c89681a7f95d.dll
1⤵
- Modifies registry class
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...