71bdc986994ff0ac066342f524ec84e994ad9240bf80f97759d102e31fbf660a

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OIExt.dll
Size

186KB
MD5

d597ec30e646421e6b1ec132de37b0a5
SHA1

72533f25c5adfe0cf0f73d928b7915c3fe9c46c9
SHA256

2cc91f9eb2946b2d19414ce4901668f25af5404eee717e50b179997dc80ab5b5
SHA512

332740d2c295e665f67f7f79cbe2130f1b473dadf8a522b2a3e46d1fd1585cd6f9fb35fcb9a13ce542eb7df14694716d5b22f16230d3ae3d97336fb0934a8a28
SSDEEP

3072:22G0wVsWsKpnZiOoOiTcU+O3j2iw+Lpk5r6Clk:2vJMTfwcv5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38FB5F89-9641-413E-86EA-2F804A88762C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38FB5F89-9641-413E-86EA-2F804A88762C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\OIShellExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\OIShellExt\ = "{38FB5F89-9641-413E-86EA-2F804A88762C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\OIShellExt	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\OIShellExt\ = "{38FB5F89-9641-413E-86EA-2F804A88762C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A2257177-F633-4E14-91ED-3691968986C4}\ = "OIExt"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\OIExt.DLL\AppID = "{A2257177-F633-4E14-91ED-3691968986C4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38FB5F89-9641-413E-86EA-2F804A88762C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\OIShellExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\OIExt.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38FB5F89-9641-413E-86EA-2F804A88762C}\ = "OIShellExt Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\OIShellExt\ = "{38FB5F89-9641-413E-86EA-2F804A88762C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\OIShellExt	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A2257177-F633-4E14-91ED-3691968986C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38FB5F89-9641-413E-86EA-2F804A88762C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\OIExt.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\OIShellExt\ = "{38FB5F89-9641-413E-86EA-2F804A88762C}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 1188	4956	regsvr32.exe	82
PID 4956 wrote to memory of 1188	4956	regsvr32.exe	82
PID 4956 wrote to memory of 1188	4956	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\OIExt.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\OIExt.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads