95c56da417b0c65b2b581e43e97c73a259627362f268f2a5bdb94fcbedfe88a4

Analysis

max time kernel
90s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ez ping/EzPingFiles/msdia110.dll
Size

1.0MB
MD5

adc43f950589b8f44a01470db994e57f
SHA1

cf7ccce7f2db431df90d8dbfc5200c55d026cd4b
SHA256

c849b3dbeb8e63f35038356f0a3e53a4116d7acad67599ca668b2bb136fe3720
SHA512

15d430762ff867f50f221285f19394453553e460169355dc0c2c44a7499d33960b7b153a36c5bce54599c4ac6c7f072576d07d040f1be396bdb8687d15e2cac1
SSDEEP

12288:YgyupQeL8wx8XhiaMQUjEAdwATQessvmp5ukkgr5yeYcc5eFN1pxxVwHBNiERH:YgyuGMzjEAdwAUpBkJeY15k1VwHBNiE

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1176	regsvr32.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\ = "dia 2.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{761D3BCD-1304-41D5-94E8-EAC54E4AC172}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{761D3BCD-1304-41D5-94E8-EAC54E4AC172}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{761D3BCD-1304-41D5-94E8-EAC54E4AC172}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D793FB46-820A-48E5-9599-6E4C3B3FB370}\ = "Debug Information Accessor w/o Global Memory Usage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC259D4D-398E-4CFF-84FD-5F44DC9DE367}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC259D4D-398E-4CFF-84FD-5F44DC9DE367}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{761D3BCD-1304-41D5-94E8-EAC54E4AC172}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ez ping\\EzPingFiles\\msdia110.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D793FB46-820A-48E5-9599-6E4C3B3FB370}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC259D4D-398E-4CFF-84FD-5F44DC9DE367}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ez ping\\EzPingFiles\\msdia110.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D793FB46-820A-48E5-9599-6E4C3B3FB370}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ez ping\\EzPingFiles\\msdia110.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D793FB46-820A-48E5-9599-6E4C3B3FB370}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC259D4D-398E-4CFF-84FD-5F44DC9DE367}\ = "Generic StackWalker"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC259D4D-398E-4CFF-84FD-5F44DC9DE367}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{761D3BCD-1304-41D5-94E8-EAC54E4AC172}\ = "Debug Information Accessor"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D793FB46-820A-48E5-9599-6E4C3B3FB370}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ez ping\\EzPingFiles\\msdia110.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{106173A0-0173-4E5C-84E7-E915422BE997}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ez ping\\EzPingFiles"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\ez ping\EzPingFiles\msdia110.dll"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads