e7540e416771a4532807a975e55c934110fd0d1f906d08a400b133e94bebe4c9

Resubmissions

11/09/2024, 18:46

240911-xe5y3swfpp 7

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DolbyAPOv251.dll
Size

1.5MB
MD5

0a88b532066bc39fddd011a75b94a75f
SHA1

0d1e2440a3a7eb2fdfe1fa60bed8c3bd1cb1c530
SHA256

5856eeffd817fba185b0a53b1cc27cd854c32a6d49c862587a0dd2cb1f22a9f5
SHA512

b1237c0711acd66c7e97d3e2528b9f25c8a6029ce26dd45edc823e2d3061cc1d1f0dde3fbbec2814869b50098ee5d95be14800fac71392a1c650d9df84dac7f9
SSDEEP

24576:h9pZdzyED/D8laLI2Ej0NCzweLRUFGveSznS7i9RHJMXq3yBwSqawO09+00atW/8:hnZ8uD8laLI2Ej0NCzweL8SrS7sdJgfg

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 33 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80A2AC54-263A-470D-BF67-5D26F6E069FE}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\Copyright = "Copyright (c) Dolby Laboratories"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\MinorVersion = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\MinOutputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\NumAPOInterfaces = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{18A5395C-F7C7-45D1-8D6D-F6BF56FE9427}\ = "DAXAPOv251"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80A2AC54-263A-470D-BF67-5D26F6E069FE}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\Flags = "12"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80A2AC54-263A-470D-BF67-5D26F6E069FE}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80A2AC54-263A-470D-BF67-5D26F6E069FE}\1.0\HELPDIR	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\MaxInputConnections = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DAX3APOv251.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DAX3APOv251.DLL\AppID = "{18A5395C-F7C7-45D1-8D6D-F6BF56FE9427}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\MaxOutputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\APOInterface0 = "{ACA32C80-30EC-4D96-9022-CC6A4F70EAE2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80A2AC54-263A-470D-BF67-5D26F6E069FE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80A2AC54-263A-470D-BF67-5D26F6E069FE}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80A2AC54-263A-470D-BF67-5D26F6E069FE}\1.0\ = "DAXAPODlllib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80A2AC54-263A-470D-BF67-5D26F6E069FE}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DolbyAPOv251.dll"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\MinInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\MaxInstances = "4294967295"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{18A5395C-F7C7-45D1-8D6D-F6BF56FE9427}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\ = "DAXAPO Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DolbyAPOv251.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80A2AC54-263A-470D-BF67-5D26F6E069FE}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80A2AC54-263A-470D-BF67-5D26F6E069FE}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\FriendlyName = "CDAXAPO"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{D9916FA0-99F7-11E7-BF21-6C0B849889E1}\MajorVersion = "1"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DolbyAPOv251.dll
1⤵
- Modifies registry class
PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads