8e52ead6497719ec558f7f3e93095fd35185f00f4c39aba85135fffc24f58f40

Analysis

max time kernel
94s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$R0.dll
Size

6.2MB
MD5

fb7da9d8c450a58b383ff42d94ebe23a
SHA1

06a106efccf80560ac0fc848b8082916a7574081
SHA256

79107685d8d6adadd68decf5d34739b6519c2467687896ce698f9188a4b6dca4
SHA512

17c0e3bc0614886c9dd2da7965f96b1c4726388d8e6248b8429515026abed9f7327c09c7154d2e6e989a55c4eabed189c49067d5a14451a85b2957784a876475
SSDEEP

49152:Q8GH9teLBY922SM9c50Iq0ikQXvnxC262mGldjoAYkVTIGRGB/Ar95VpeOOQ1KT:xM9bYAUsxYOOyKT

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\ = "Extract Handler Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\ = "Thumbnail Handler Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ai\ShellEx	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.psd\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{75F9C120-AE93-4372-ACCA-8BF6BB613A02}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\ = "ThumbnailLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\ = "Extract Handler Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.psd\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{1F45976A-9305-4A2F-85B3-E950C29436AA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbi\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbi\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.psd\ShellEx	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ai\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\ = "Thumbnail Handler Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.psd\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ai\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbi\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{08FF5222-38A4-487E-A298-2DCB51EE9E06}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.psd\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\ = "Extract Handler Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbi\ShellEx	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\Version\ = "1.0"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$R0.dll
1⤵
- Modifies registry class
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads