Analysis
-
max time kernel
146s -
max time network
124s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
29-06-2020 15:36
Static task
static1
Behavioral task
behavioral1
Sample
june29.dll
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
-
Target
june29.dll
-
Size
573KB
-
MD5
33a58437b5bc8f91e08960d2faa5f559
-
SHA1
f015e16c3847edd004aba53f358fe43b28c4f818
-
SHA256
dd84bd6db3500e786976d5c10fd2388a46dd5c34f79abd5dff624b9a568637aa
-
SHA512
0fa6349def8590aafc8badf198d1abc7e9f906eec5852088270e2ba11986a918ad6b620c2a545def82c694f340e05ed3a3ad89deb780cc7a23ead1b3f1930f42
Score
10/10
Malware Config
Signatures
-
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 1180 net.exe 1380 net.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 676 wrote to memory of 872 676 rundll32.exe 24 PID 676 wrote to memory of 872 676 rundll32.exe 24 PID 676 wrote to memory of 872 676 rundll32.exe 24 PID 676 wrote to memory of 872 676 rundll32.exe 24 PID 676 wrote to memory of 872 676 rundll32.exe 24 PID 676 wrote to memory of 872 676 rundll32.exe 24 PID 676 wrote to memory of 872 676 rundll32.exe 24 PID 872 wrote to memory of 1844 872 rundll32.exe 27 PID 872 wrote to memory of 1844 872 rundll32.exe 27 PID 872 wrote to memory of 1844 872 rundll32.exe 27 PID 872 wrote to memory of 1844 872 rundll32.exe 27 PID 872 wrote to memory of 1844 872 rundll32.exe 27 PID 872 wrote to memory of 1844 872 rundll32.exe 27 PID 872 wrote to memory of 1844 872 rundll32.exe 27 PID 872 wrote to memory of 1844 872 rundll32.exe 27 PID 872 wrote to memory of 1844 872 rundll32.exe 27 PID 1844 wrote to memory of 1584 1844 msiexec.exe 30 PID 1844 wrote to memory of 1584 1844 msiexec.exe 30 PID 1844 wrote to memory of 1584 1844 msiexec.exe 30 PID 1844 wrote to memory of 1584 1844 msiexec.exe 30 PID 1584 wrote to memory of 1636 1584 cmd.exe 32 PID 1584 wrote to memory of 1636 1584 cmd.exe 32 PID 1584 wrote to memory of 1636 1584 cmd.exe 32 PID 1584 wrote to memory of 1636 1584 cmd.exe 32 PID 1844 wrote to memory of 1984 1844 msiexec.exe 33 PID 1844 wrote to memory of 1984 1844 msiexec.exe 33 PID 1844 wrote to memory of 1984 1844 msiexec.exe 33 PID 1844 wrote to memory of 1984 1844 msiexec.exe 33 PID 1984 wrote to memory of 1944 1984 cmd.exe 35 PID 1984 wrote to memory of 1944 1984 cmd.exe 35 PID 1984 wrote to memory of 1944 1984 cmd.exe 35 PID 1984 wrote to memory of 1944 1984 cmd.exe 35 PID 1944 wrote to memory of 2044 1944 net.exe 36 PID 1944 wrote to memory of 2044 1944 net.exe 36 PID 1944 wrote to memory of 2044 1944 net.exe 36 PID 1944 wrote to memory of 2044 1944 net.exe 36 PID 1844 wrote to memory of 2032 1844 msiexec.exe 37 PID 1844 wrote to memory of 2032 1844 msiexec.exe 37 PID 1844 wrote to memory of 2032 1844 msiexec.exe 37 PID 1844 wrote to memory of 2032 1844 msiexec.exe 37 PID 2032 wrote to memory of 1180 2032 cmd.exe 39 PID 2032 wrote to memory of 1180 2032 cmd.exe 39 PID 2032 wrote to memory of 1180 2032 cmd.exe 39 PID 2032 wrote to memory of 1180 2032 cmd.exe 39 PID 1844 wrote to memory of 1412 1844 msiexec.exe 40 PID 1844 wrote to memory of 1412 1844 msiexec.exe 40 PID 1844 wrote to memory of 1412 1844 msiexec.exe 40 PID 1844 wrote to memory of 1412 1844 msiexec.exe 40 PID 1412 wrote to memory of 1380 1412 cmd.exe 42 PID 1412 wrote to memory of 1380 1412 cmd.exe 42 PID 1412 wrote to memory of 1380 1412 cmd.exe 42 PID 1412 wrote to memory of 1380 1412 cmd.exe 42 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1844 msiexec.exe -
Blacklisted process makes network request 10 IoCs
flow pid Process 6 1844 msiexec.exe 7 1844 msiexec.exe 8 1844 msiexec.exe 9 1844 msiexec.exe 10 1844 msiexec.exe 11 1844 msiexec.exe 12 1844 msiexec.exe 13 1844 msiexec.exe 14 1844 msiexec.exe 15 1844 msiexec.exe -
Modifies service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas ipconfig.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs ipconfig.exe -
Runs net.exe
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 872 set thread context of 1844 872 rundll32.exe 27 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 1844 msiexec.exe Token: SeSecurityPrivilege 1844 msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\june29.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\june29.dll,#12⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:872 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1844 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ipconfig /all4⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all5⤵
- Modifies service
PID:1636
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net config workstation4⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\net.exenet config workstation5⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 config workstation6⤵PID:2044
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all4⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\net.exenet view /all5⤵
- Discovers systems in the same network
PID:1180
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net view /all /domain4⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\net.exenet view /all /domain5⤵
- Discovers systems in the same network
PID:1380
-
-
-
-