f838f4d9756a55960101126cf89439aceec923056e98e20e88240becdace8001

Analysis

max time kernel
129s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Python/Launcher/pyshellext.amd64.dll
Size

49KB
MD5

740dcc24ba59f6205de3d5c5575a19a7
SHA1

2a911e51bb2571f5792c49008a2a2103fc0ed0ad
SHA256

6a4a987548a8fa13c8678fdae921c2084a92048e6002400d5c48d695c502e0bd
SHA512

e652043da39b4fe631e428d8422b642cf3bcab0b2068befa7056cfc8c601cfa95f7c6faa552f53dc3f773834d192b3eda7f69bdb78ece6bb0cb9278779cd8d24
SSDEEP

1536:nDkRbNy163+jd/Coq/JPY7DxIsbmdMHXVMYuYJsZ56obHKG60WogRjNfuZdRzAHo:D6bM163+jd/Coq/JPY7DxIsbmdMHXVMP

Score

5^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Python\\Launcher\\pyshellext.amd64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Python\Launcher\pyshellext.amd64.dll
1⤵
- Modifies registry class
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads