f139ed18bca38e4e61fa88f94f0a070d217df1c1f647191510253352724ea1b5

Analysis

max time kernel
88s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20241007-fr
resource tags

arch:x64arch:x86image:win11-20241007-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
14-01-2025 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OblivionCheatVIP 2.1/Addons/Macro/MapsBtSvcProxy.dll
Size

40KB
MD5

ae54de5d281d6cabf82cf88bc0e5011f
SHA1

2b27d48630a1b9e7a82ae32459c18f337eb5c50e
SHA256

a94fdfed0e3cb0aaaa9a727d150157fd0179ffcbe03adec5fdcd3e186c1a457f
SHA512

cbc541b4f40d8e3ba452f35b31cafedb492be6981f425b333d8ae397e01247cba0ada80c6313b99a00f6e4307ff889944d6e4190e953f832fe0218227c4db24a
SSDEEP

192:G2obK6DtPHd5Qk1tRSmmmDVwaQ9jdg7QA/eQ9cQ7p97vE1VzkdHWR6Wk:Gjbfd5jzIa37rehQn7WVzsHWR6Wk

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1965FEA3-3896-438B-B789-F5981797E7E7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1965FEA3-3896-438B-B789-F5981797E7E7}\InProcServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Interface	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\OblivionCheatVIP 2.1\Addons\Macro\MapsBtSvcProxy.dll"
1⤵
- Modifies registry class
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads