Overview
overview
10Static
static
3New folder...ta.exe
windows10-ltsc 2021-x64
New folder...io.dll
windows10-ltsc 2021-x64
1New folder...se.dll
windows10-ltsc 2021-x64
3New folder...up.exe
windows10-ltsc 2021-x64
10New folder...nt.dll
windows10-ltsc 2021-x64
3New folder...on.dll
windows10-ltsc 2021-x64
3New folder...te.dll
windows10-ltsc 2021-x64
3New folder...e3.dll
windows10-ltsc 2021-x64
3New folder...ps.dll
windows10-ltsc 2021-x64
5New folder...sr.dll
windows10-ltsc 2021-x64
1New folder...32.dll
windows10-ltsc 2021-x64
3New folder...64.dll
windows10-ltsc 2021-x64
1New folder...ts.dll
windows10-ltsc 2021-x64
1New folder...-1.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1New folder...-0.dll
windows10-ltsc 2021-x64
1Analysis
-
max time kernel
97s -
max time network
142s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
21-11-2024 09:47
Static task
static1
Behavioral task
behavioral1
Sample
New folder (8)/Data.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
New folder (8)/NAudio.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral3
Sample
New folder (8)/RcClientBase.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
New folder (8)/Setup.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral5
Sample
New folder (8)/UpdateClient.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral6
Sample
New folder (8)/UpdateCommon.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral7
Sample
New folder (8)/datastate.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral8
Sample
New folder (8)/sqlite3.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral9
Sample
New folder (8)/updater/nvdisps.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral10
Sample
New folder (8)/updater/nvdispsr.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral11
Sample
New folder (8)/updater/nvptxJitCompiler32.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral12
Sample
New folder (8)/x64/trading_api64.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral13
Sample
New folder (8)/x64/tradingnetworkingsockets.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral14
Sample
New folder (8)/x86/api-ms-win-core-processthreads-l1-1-1.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral15
Sample
New folder (8)/x86/api-ms-win-core-profile-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral16
Sample
New folder (8)/x86/api-ms-win-core-rtlsupport-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral17
Sample
New folder (8)/x86/api-ms-win-core-string-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral18
Sample
New folder (8)/x86/api-ms-win-core-synch-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral19
Sample
New folder (8)/x86/api-ms-win-core-synch-l1-2-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral20
Sample
New folder (8)/x86/api-ms-win-core-sysinfo-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral21
Sample
New folder (8)/x86/api-ms-win-core-timezone-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral22
Sample
New folder (8)/x86/api-ms-win-core-util-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral23
Sample
New folder (8)/x86/api-ms-win-crt-conio-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral24
Sample
New folder (8)/x86/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral25
Sample
New folder (8)/x86/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral26
Sample
New folder (8)/x86/api-ms-win-crt-filesystem-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral27
Sample
New folder (8)/x86/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral28
Sample
New folder (8)/x86/api-ms-win-crt-locale-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral29
Sample
New folder (8)/x86/api-ms-win-crt-math-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral30
Sample
New folder (8)/x86/api-ms-win-crt-multibyte-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral31
Sample
New folder (8)/x86/api-ms-win-crt-private-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral32
Sample
New folder (8)/x86/api-ms-win-crt-process-l1-1-0.dll
Resource
win10ltsc2021-20241023-en
General
-
Target
New folder (8)/updater/nvdisps.dll
-
Size
11.1MB
-
MD5
da3e5ecda1487fdbcc6d7db314815696
-
SHA1
b2775d5a94a2af489590e1544dbff7176c39d389
-
SHA256
77173b4b61b59eca507ca3ece87a77a87e4e77a48dd162ba813d61cb0513421d
-
SHA512
cb3a14dbb15fad5bee97f3ec2236c7946778b1c884b38086026029f1bbbf20648e420bd829a82b8796f420ee50a5ef896bdc9aaccc67b82ac4e89eb67294c656
-
SSDEEP
98304:XNTNmlyn5aaKgwF2MxtrjgEe2eVivataUN3Dumf/S+CJ4RoLERm6iVv/lraqXtxG:XNT8lxjVWiCwUN3d/RbCv/9tx/KLce3
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{73BCA54E-6AEB-4597-8F27-E1284FF12722}\ProgID\ = "DisplayServer.ServerMain.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.Power\CurVer\ = "DisplayServer.Power.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{51840041-B26F-4843-B358-22ABB067396C}\ProgID\ = "DisplayServer.ScreenTimingDVI.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.SetupDigitalAudio\CLSID\ = "{A3B877C7-83CA-4c9b-87FB-BE0D518C2441}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.ChangeResExt.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91363F1E-E7CA-4959-85D6-963719EC79FC}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{26A37DC6-935D-439B-80DD-C1006AE13D71} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6E4B938E-4BA1-4E8D-BCBA-8C51CE95F94F}\ProgID\ = "DisplayServer.MultiMon.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074BFFFD-4E50-42c1-A7EB-40D9D70F2471}\TypeLib\ = "{25EBA1D0-EB51-4CBE-8515-23E81DF77F97}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.AdjustSizePosExt.1\ = "AdjustSizePosExt Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.DualView.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1BC39379-8D90-4F18-8817-795C57163770}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6E4B938E-4BA1-4E8D-BCBA-8C51CE95F94F}\TypeLib\ = "{25EBA1D0-EB51-4CBE-8515-23E81DF77F97}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7945F814-7BFB-4506-A113-2BD66CDC713A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\New folder (8)\\updater\\nvdisps.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6017A978-93AD-4F2F-9E2D-07CF8C8DEBC4}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.VideoAudioControl\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{25EBA1D0-EB51-4CBE-8515-23E81DF77F97}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.AdjustSizePosExt regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6539579C-2657-45E5-985F-835E197959C2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{894BF76C-115F-44B7-9B32-ABFA7E6A804A}\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A22E68F-887C-4221-9DF1-EE0B3AC76497}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6539579C-2657-45E5-985F-835E197959C2}\AppID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.NameDisp.1\ = "NameDisp Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.VideoAudioControl.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.AdjustDesktopSizePos.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.CustomRez.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEF5290C-7F3D-4640-93F2-F189DC616510}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.SetupDigitalAudio\ = "SetupDigitalAudio Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.AdjustDesktopSizePos\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{074BFFFD-4E50-42c1-A7EB-40D9D70F2471}\ProgID\ = "DisplayServer.AdjustDesktopSizePos.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A22E68F-887C-4221-9DF1-EE0B3AC76497}\ = "NameDisp Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{51840041-B26F-4843-B358-22ABB067396C}\VersionIndependentProgID\ = "DisplayServer.ScreenTimingDVI" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.ScreenMove\CLSID\ = "{1BC39379-8D90-4F18-8817-795C57163770}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.CategoryMultiMon.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88FC94D1-2ABB-42CF-8A07-4BC54F66EDDF}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6A22E68F-887C-4221-9DF1-EE0B3AC76497}\AppID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A158544D-66FA-4F19-8806-F3CA2E2A4C52}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.ServerMain.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{25EBA1D0-EB51-4CBE-8515-23E81DF77F97}\1.0\0\win64 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.ChangeResExt\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.CustomRez\CurVer\ = "DisplayServer.CustomRez.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6017A978-93AD-4F2F-9E2D-07CF8C8DEBC4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\New folder (8)\\updater\\nvdisps.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.ScreenMove regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{88FC94D1-2ABB-42CF-8A07-4BC54F66EDDF}\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.IdentifyDisp regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6E4B938E-4BA1-4E8D-BCBA-8C51CE95F94F}\VersionIndependentProgID\ = "DisplayServer.MultiMon" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.Power.1\CLSID\ = "{A158544D-66FA-4F19-8806-F3CA2E2A4C52}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3B877C7-83CA-4c9b-87FB-BE0D518C2441}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80BA3813-908F-4D4C-A5FF-263640AD5B7A}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.CategoryAppearance.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.MultiView.1\CLSID\ = "{894BF76C-115F-44B7-9B32-ABFA7E6A804A}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7945F814-7BFB-4506-A113-2BD66CDC713A}\ = "DualView Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEF5290C-7F3D-4640-93F2-F189DC616510}\ = "VideoHDCPStatus Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.ColorSettingsAdv\ = "ColorSettingsAdv Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7945F814-7BFB-4506-A113-2BD66CDC713A}\VersionIndependentProgID\ = "DisplayServer.DualView" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.VideoAudioControl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.RotateDisplay\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.RotateDisplay\CurVer\ = "DisplayServer.RotateDisplay.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6539579C-2657-45E5-985F-835E197959C2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\New folder (8)\\updater\\nvdisps.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.CategoryAppearance\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B53EBC0C-2251-4AE2-9818-FD6AAF843EC2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\New folder (8)\\updater\\nvdisps.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63005CD0-8541-439c-A66A-617F4B1F2BCB}\TypeLib\ = "{25EBA1D0-EB51-4CBE-8515-23E81DF77F97}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DisplayServer.ColorCorrection regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AAB8F985-EADA-428B-8636-270F58E1F1EF}\ProgID regsvr32.exe