5c42ee9854d6566d3138fe23cb9c973e74444baecb10fcfd80e772e6dc1c47f0

Analysis

max time kernel
139s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x64/SSCbFsMntNtf3.dll
Size

160KB
MD5

c9940a2b243ec73ade7a65e4572fde6b
SHA1

c4bd632f0135d75e7adf94f02fba22c6a9ff7342
SHA256

7bf8ea86624b461767ddf5573cfe9a55814efa6f67d808c1d91c61a45cd06466
SHA512

a8589e417cdaa42161eeb9af4aa104b4b7232e6333498cbe9e1e6b8090399b3f97471f1099fb051385142e051a8f82c834e2b8b0d3882b72ba74bff16b7a01b2
SSDEEP

3072:HCIOd79Gi8PcOocNMx3FiTrMIntrqzbp1Algnif+G/CaWLEuA4:HCIOdpn8PcOoH3FiTQIntmGDLWLbA4

Score

10^/10

persistence privilege_escalation

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\EldosMountNotificator = "{C28617FD-4FE7-4043-AD51-C8132CE90106}"	regsvr32.exe

Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{C28617FD-4FE7-4043-AD51-C8132CE90106} = "Virtual Storage Mount Notification"	regsvr32.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 62 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib\ = "{239FDE2C-A916-45FB-91FA-78C905F3CE56}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon\CLSID\ = "{69925D1B-6A0F-4413-861A-81AB98039DB9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\AppID = "{A0CEE1D2-71DC-49CD-AF11-087292B8303A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A0CEE1D2-71DC-49CD-AF11-087292B8303A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SSCbFsMntNtf3.dll\AppID = "{A0CEE1D2-71DC-49CD-AF11-087292B8303A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A0CEE1D2-71DC-49CD-AF11-087292B8303A}\ = "SSVSMntNtf"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon\ = "SSVSMntNtfOverlayIcon Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\VersionIndependentProgID\ = "SSVSMntNtf.SSVSMntNtfOverlayIcon"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\AppID = "{A0CEE1D2-71DC-49CD-AF11-087292B8303A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon.1\CLSID\ = "{69925D1B-6A0F-4413-861A-81AB98039DB9}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon\CurVer\ = "SSVSMntNtf.SSVSMntNtfOverlayIcon.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x64\\SSCbFsMntNtf3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\ = "Virtual Storage Mount Notification"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\ = "VSMntNtf 2.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SSCbFsMntNtf3.dll	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\ = "SSVSMntNtfOverlayIcon Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x64\\SSCbFsMntNtf3.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\ProgID\ = "SSVSMntNtf.SSVSMntNtfOverlayIcon.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x64\\SSCbFsMntNtf3.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\TypeLib\ = "{2A2336CC-D779-4C37-9F96-6A2E795C607E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\TypeLib\ = "{239FDE2C-A916-45FB-91FA-78C905F3CE56}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69925D1B-6A0F-4413-861A-81AB98039DB9}\TypeLib\ = "{C11574EB-F135-40F4-B341-9B29412BA733}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{239FDE2C-A916-45FB-91FA-78C905F3CE56}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x64"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ = "IVSMntNtfOverlayIcon"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{831396BE-C006-4246-A2A0-10550334A7CE}\ = "IVSMntNtfOverlayIcon"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C28617FD-4FE7-4043-AD51-C8132CE90106}\VersionIndependentProgID\ = "SSVSMntNtf.MountShlExt"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SSVSMntNtf.SSVSMntNtfOverlayIcon.1\ = "SSVSMntNtfOverlayIcon Class"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\x64\SSCbFsMntNtf3.dll
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies Shared Task Scheduler registry keys
- Modifies registry class
PID:692