Overview
overview
10Static
static
10Crack.exe
windows7-x64
10Crack.exe
windows10-2004-x64
10WindowsManager.dll
windows7-x64
1WindowsManager.dll
windows10-2004-x64
1assets/Tap...er.dll
windows7-x64
1assets/Tap...er.dll
windows10-2004-x64
1assets/WSe...in.dll
windows10-2004-x64
5assets/Wpc...el.dll
windows10-2004-x64
1assets/WsUpgrade.dll
windows10-2004-x64
7library/AR...et.dll
windows7-x64
1library/AR...et.dll
windows10-2004-x64
1library/Autofac.dll
windows7-x64
1library/Autofac.dll
windows10-2004-x64
1library/Ga...rm.dll
windows7-x64
1library/Ga...rm.dll
windows10-2004-x64
1library/Ga...ht.dll
windows7-x64
1library/Ga...ht.dll
windows10-2004-x64
1Analysis
-
max time kernel
92s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-11-2024 11:31
Behavioral task
behavioral1
Sample
Crack.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Crack.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
WindowsManager.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
WindowsManager.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
assets/TapInstaller.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
assets/TapInstaller.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
assets/WSearchMigPlugin.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
assets/WpcMigration.Uplevel.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
assets/WsUpgrade.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
library/ARSoft.Tools.Net.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
library/ARSoft.Tools.Net.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
library/Autofac.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral13
Sample
library/Autofac.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
library/GalaSoft.MvvmLight.Platform.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral15
Sample
library/GalaSoft.MvvmLight.Platform.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
library/GalaSoft.MvvmLight.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral17
Sample
library/GalaSoft.MvvmLight.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
assets/WsUpgrade.dll
-
Size
201KB
-
MD5
9d99b0e88cc4eaa43141dea9e31ed3be
-
SHA1
442e48476650e97cfac8e8088a7315b9804be0c1
-
SHA256
061de26f44da62a17eecb71f078ef90a9c8784e7c58500984314c74b32c12e46
-
SHA512
2a0cd7adf67e535cf4a40988d6da4ee69970694875504ea7f7e68cef19e01675557bd3021d867c2bb837d1c3e8287d710259c921967324255c53d0351c6d48df
-
SSDEEP
3072:a0qV+qDh/7k8Rr92ZSbTP6c27UxDOUreaNQbmOhG7/tfxvharBjnt:a0qVHV1IwTPrFtOe/tzarB7
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies registry class 27 IoCs
Processes:
regsvr32.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WsUpgrade.WsUpgradePlugin.1\CLSID\ = "{8707fcd0-e62a-4451-b224-7707ffe1c286}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\AppID = "{b147aea4-d71d-4715-be15-becc101ac2c9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\wsupgrade.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\wsupgrade.DLL\AppID = "{b147aea4-d71d-4715-be15-becc101ac2c9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WsUpgrade.WsUpgradePlugin regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WsUpgrade.WsUpgradePlugin\CurVer\ = "WsUpgrade.WsUpgradePlugin.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\ = "CWsUpgradePlugin Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WsUpgrade.WsUpgradePlugin.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WsUpgrade.WsUpgradePlugin\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WsUpgrade.WsUpgradePlugin\CLSID\ = "{8707fcd0-e62a-4451-b224-7707ffe1c286}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\InprocServer32\ThreadingModel = "free" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\TypeLib\ = "{B147AEA4-D71D-4715-BE15-BECC101AC2C9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WsUpgrade.WsUpgradePlugin.1\ = "CWsUpgradePlugin Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WsUpgrade.WsUpgradePlugin\ = "CWsUpgradePlugin Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\VersionIndependentProgID\ = "WsUpgrade.WsUpgradePlugin" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\assets\\WsUpgrade.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{b147aea4-d71d-4715-be15-becc101ac2c9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{b147aea4-d71d-4715-be15-becc101ac2c9}\ = "WsUpgradePlugin" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WsUpgrade.WsUpgradePlugin.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WsUpgrade.WsUpgradePlugin\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8707fcd0-e62a-4451-b224-7707ffe1c286}\ProgID\ = "WsUpgrade.WsUpgradePlugin.1" regsvr32.exe