4dc302e1f7cf8bdc4983fdf02cf5b13bcd9314bb87953b9c6797187700192665

Analysis

max time kernel
104s
max time network
33s
platform
windows7_x64
resource
win7v200430
submitted
24/06/2020, 13:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
maintenanceservice_Win32_DllRelease.dll
Size 201KB
Sample200624-9tlj3wp7he
SHA256 4dc302e1f7cf8bdc4983fdf02cf5b13bcd9314bb87953b9c6797187700192665
MD5 84aa5a019b9c50118a9a42a197358060
SHA1 e6b4362f843437789b2d7854a390a372a28ffc9a
SHA512 a24a4751c255e2375f64dfc0f605d710b273f66c15f6cc35a1e53c57a08108a98953c92f4b3efe96035b64ed4d24ee9da385f75dce5911577102a88b2ca486ba
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1532	1500	rundll32.exe	24
PID 1500 wrote to memory of 1532	1500	rundll32.exe	24
PID 1500 wrote to memory of 1532	1500	rundll32.exe	24
PID 1500 wrote to memory of 1532	1500	rundll32.exe	24
PID 1500 wrote to memory of 1532	1500	rundll32.exe	24
PID 1500 wrote to memory of 1532	1500	rundll32.exe	24
PID 1500 wrote to memory of 1532	1500	rundll32.exe	24

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1532	rundll32.exe
1532	rundll32.exe

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaintenanceService = "C:\\Users\\Admin\\AppData\\Local\\Mozilla\\Maintenance Service\\MaintenanceService.exe.lnk"	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\maintenanceservice_Win32_DllRelease.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\maintenanceservice_Win32_DllRelease.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Adds Run entry to start application
  PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads