Overview
overview
10Static
static
3__x64___se...ip.dll
windows10-2004-x64
8__x64___se...tl.dll
windows10-2004-x64
1__x64___se...ps.dll
windows10-2004-x64
5__x64___se...um.dll
windows10-2004-x64
7__x64___se...el.dll
windows10-2004-x64
1__x64___se...nd.dll
windows10-2004-x64
1__x64___se...eg.dll
windows10-2004-x64
1__x64___se...vc.dll
windows10-2004-x64
1__x64___se...ep.dll
windows10-2004-x64
1__x64___se...fm.dll
windows10-2004-x64
1__x64___se...sh.dll
windows10-2004-x64
1__x64___se...is.dll
windows10-2004-x64
1__x64___se...ip.dll
windows10-2004-x64
8__x64___se...or.dll
windows10-2004-x64
1__x64___se...um.dll
windows10-2004-x64
1__x64___se...ui.dll
windows10-2004-x64
1__x64___se...up.msi
windows7-x64
6__x64___se...up.msi
windows10-2004-x64
10__x64___se...PS.dll
windows10-2004-x64
1__x64___se...pi.dll
windows10-2004-x64
1__x64___se...vc.dll
windows10-2004-x64
1__x64___se...ge.dll
windows10-2004-x64
1Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 14:14
Static task
static1
Behavioral task
behavioral1
Sample
__x64___setup___x32__/AppxSip/AppxSip.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
__x64___setup___x32__/AppxSip/MSVidCtl.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
__x64___setup___x32__/AppxSip/deploymentcsps.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
__x64___setup___x32__/AppxSip/devenum.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
__x64___setup___x32__/dsreg/dcntel.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
__x64___setup___x32__/dsreg/dsound.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
__x64___setup___x32__/dsreg/dsreg.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
__x64___setup___x32__/dsreg/sensrsvc.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
__x64___setup___x32__/netprofm/TapiSysprep.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
__x64___setup___x32__/netprofm/netprofm.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
__x64___setup___x32__/netprofm/rpcnsh.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
__x64___setup___x32__/netprofm/socialapis.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
__x64___setup___x32__/pcwum/AppxSip.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
__x64___setup___x32__/pcwum/asferror.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
__x64___setup___x32__/pcwum/pcwum.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
__x64___setup___x32__/pcwum/pdhui.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
__x64___setup___x32__/setup.msi
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
__x64___setup___x32__/setup.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
__x64___setup___x32__/wcimage/SEMgrPS.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
__x64___setup___x32__/wcimage/SensorsApi.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
__x64___setup___x32__/wcimage/netprofmsvc.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
__x64___setup___x32__/wcimage/wcimage.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
General
-
Target
__x64___setup___x32__/AppxSip/devenum.dll
-
Size
108KB
-
MD5
13dc564be50b850d4ba18d8b28ed7802
-
SHA1
17e703b95bd1ba6beeacb498d4494494e14b7266
-
SHA256
d4c23365d6c16ed6be52fe620742c1fde00d2cb14c3844c7e633b2a251c4c39d
-
SHA512
145da4efdeb0e710e0116462f957d2083c7ad3ee47269fdd853145a1f37ec37b888ad2a585f5965b61525a8848488ae4903eca7550208cda664b5fab9084ced6
-
SSDEEP
1536:W0s0VKB22Wola4XD1HKVxY+e1DxJjdAeWH3z4OmFeTNvM3mBG52hhvzrDQdRC3am:lOBDJKVuaeWHjtmITNSmBG5Ghvbh
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies registry class 43 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\ = "ICM Class Manager" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\ = "ACM Class Manager" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4EFE2452-168A-11d1-BC76-00C04FB9453B}\ = "MidiOut Class Manager" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4EFE2452-168A-11d1-BC76-00C04FB9453B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\__x64___setup___x32__\\AppxSip\\devenum.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\FriendlyName = "Video Capture Sources" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Merit = "6291456" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\__x64___setup___x32__\\AppxSip\\devenum.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\FriendlyName = "Video Compressors" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{E0F158E1-CB04-11d0-BD4E-00A0C911CE86}\FriendlyName = "Audio Renderers" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{CC7BFB46-F175-11d1-A392-00E0291F3959}\FriendlyName = "Device Control Filters" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{CC7BFB46-F175-11d1-A392-00E0291F3959}\CLSID = "{CC7BFB46-F175-11d1-A392-00E0291F3959}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\ = "ActiveMovie Filter Class Manager" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33D9A762-90C8-11d0-BD43-00A0C911CE86}\ = "WaveIn Class Manager" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{083863F1-70DE-11d0-BD40-00A0C911CE86}\CLSID = "{083863F1-70DE-11d0-BD40-00A0C911CE86}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{33D9A762-90C8-11d0-BD43-00A0C911CE86}\CLSID = "{33D9A762-90C8-11d0-BD43-00A0C911CE86}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\CLSID = "{33D9A761-90C8-11d0-BD43-00A0C911CE86}" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{E0F158E1-CB04-11d0-BD4E-00A0C911CE86}\Merit = "6291456" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{CC7BFB41-F175-11d1-A392-00E0291F3959}\CLSID = "{CC7BFB41-F175-11d1-A392-00E0291F3959}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\ = "VFW Capture Class Manager" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33D9A762-90C8-11d0-BD43-00A0C911CE86}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\CLSID = "{860BB310-5D01-11d0-BD3B-00A0C911CE86}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{083863F1-70DE-11d0-BD40-00A0C911CE86}\FriendlyName = "DirectShow Filters" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\CLSID = "{33D9A760-90C8-11d0-BD43-00A0C911CE86}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{CC7BFB41-F175-11d1-A392-00E0291F3959}\FriendlyName = "External Renderers" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\__x64___setup___x32__\\AppxSip\\devenum.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\ = "ActiveMovie Filter Categories" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{4EFE2452-168A-11d1-BC76-00C04FB9453B}\FriendlyName = "Midi Renderers" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{4EFE2452-168A-11d1-BC76-00C04FB9453B}\Merit = "6291456" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{4EFE2452-168A-11d1-BC76-00C04FB9453B}\CLSID = "{4EFE2452-168A-11d1-BC76-00C04FB9453B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11D0-BD43-00A0C911CE86}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\__x64___setup___x32__\\AppxSip\\devenum.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33D9A762-90C8-11d0-BD43-00A0C911CE86}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\__x64___setup___x32__\\AppxSip\\devenum.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0F158E1-CB04-11d0-BD4E-00A0C911CE86}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4EFE2452-168A-11d1-BC76-00C04FB9453B}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{33D9A762-90C8-11d0-BD43-00A0C911CE86}\FriendlyName = "Audio Capture Sources" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{33D9A761-90C8-11d0-BD43-00A0C911CE86}\FriendlyName = "Audio Compressors" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{E0F158E1-CB04-11d0-BD4E-00A0C911CE86}\CLSID = "{E0F158E1-CB04-11d0-BD4E-00A0C911CE86}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0F158E1-CB04-11d0-BD4E-00A0C911CE86}\ = "WaveOut and DSound Class Manager" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E0F158E1-CB04-11d0-BD4E-00A0C911CE86}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\__x64___setup___x32__\\AppxSip\\devenum.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\__x64___setup___x32__\\AppxSip\\devenum.dll" regsvr32.exe