d1a7feccbbfced69b6d3bf9ca84d10cb3cda24b1a3608589efe2b93ee37e1bab

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1a7feccbbfced69b6d3bf9ca84d10cb3cda24b1a3608589efe2b93ee37e1bab.dll
Size

1.8MB
MD5

46164f39f2e5aab1db617a40af444806
SHA1

15e4e673a0608a3657788d5776eae86a4d2189fa
SHA256

d1a7feccbbfced69b6d3bf9ca84d10cb3cda24b1a3608589efe2b93ee37e1bab
SHA512

0434cc71f5a1d5c6acc83e0ae36baff7dac638a10ad013822b4735071757d25de44cd4e5d4d90fe7cf45dc1bd2e1e051dd5241a11436409900e40a8f15f6f72f
SSDEEP

49152:IEN5UdaKqJg5Q+P56Gm12PjqAFqy0+9B7SEvRq0:IEE2AQ+P56GmAjlEs9Bp

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\FseLocallog\LckTrsfPlug.log	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F12AE04-863C-426B-A005-3F8C798B7877}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D107A66-0564-4E33-B0FD-CF9089BD6BE1}\ = "LckTrsfPlug Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F12AE04-863C-426B-A005-3F8C798B7877}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F12AE04-863C-426B-A005-3F8C798B7877}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\ProgID\ = "SETKEYINFO.SetKeyInfoCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}\ = "_DSetKeyInfoEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F12AE04-863C-426B-A005-3F8C798B7877}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SETKEYINFO.SetKeyInfoCtrl.1\ = "LckTrsfPlug Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D107A66-0564-4E33-B0FD-CF9089BD6BE1}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SETKEYINFO.SetKeyInfoCtrl.1\CLSID\ = "{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\TypeLib\ = "{7F12AE04-863C-426B-A005-3F8C798B7877}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}\TypeLib\ = "{7F12AE04-863C-426B-A005-3F8C798B7877}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D1A7FE~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F12AE04-863C-426B-A005-3F8C798B7877}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}\TypeLib\ = "{7F12AE04-863C-426B-A005-3F8C798B7877}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}\ = "_DSetKeyInfoEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F12AE04-863C-426B-A005-3F8C798B7877}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D1A7FE~1.DLL, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F12AE04-863C-426B-A005-3F8C798B7877}\1.0\ = "SetKeyInfo ActiveX Control module"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}\ = "_DSetKeyInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}\TypeLib\ = "{7F12AE04-863C-426B-A005-3F8C798B7877}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7035FE04-2D99-4DD2-9209-E92557B3D7E1}\ = "_DSetKeyInfo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SETKEYINFO.SetKeyInfoCtrl.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SETKEYINFO.SetKeyInfoCtrl.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C5D1E1C-0687-4B9F-9A3D-20AEB1661315}\Control\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F12AE04-863C-426B-A005-3F8C798B7877}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d1a7feccbbfced69b6d3bf9ca84d10cb3cda24b1a3608589efe2b93ee37e1bab.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F12AE04-863C-426B-A005-3F8C798B7877}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}\TypeLib\ = "{7F12AE04-863C-426B-A005-3F8C798B7877}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4AC7400C-EAF7-4A80-BD66-E6A048A5159C}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D107A66-0564-4E33-B0FD-CF9089BD6BE1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D1A7FE~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7F12AE04-863C-426B-A005-3F8C798B7877}\1.0	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1388	regsvr32.exe
1388	regsvr32.exe
1388	regsvr32.exe
1388	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1388	2560	regsvr32.exe	83
PID 2560 wrote to memory of 1388	2560	regsvr32.exe	83
PID 2560 wrote to memory of 1388	2560	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d1a7feccbbfced69b6d3bf9ca84d10cb3cda24b1a3608589efe2b93ee37e1bab.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\d1a7feccbbfced69b6d3bf9ca84d10cb3cda24b1a3608589efe2b93ee37e1bab.dll
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\FSELocalLog\LckTrsfPlug.log

Filesize
5KB

MD5
448f535138f1f19a537884f7dda642f4

SHA1
54136c33a9ef8cfd6db641a18c3d47faa931c025

SHA256
794ba56865357c8212caeead969ce3b715f36432acfaca92e715932a62466cb2

SHA512
03b125108a91c073290dfa95a523121425d059752d927fcb779d7f607dd30e2e523d94453dbde118aa82bfa9c6ce2a6d13152f66bd05b66aa1ebd0e0303b899f

Download Submit