Overview

overview

1

Static

static

2020-07-09...in.dll

windows7_x64

1

2020-07-09...in.dll

windows10_x64

1

Analysis

  • max time kernel
    140s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    11/07/2020, 07:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2020-07-09-Ursnif-DLL-example-02-of-10.bin.dll

  • Size

    277KB

  • MD5

    e95584d6bac3bf42be449965999f8b28

  • SHA1

    2e61ab41d2cf69b4a1bcf13c47252a5164bd95e4

  • SHA256

    6a39a3e7387f3d214042b2d9d99f4d6de18303d56ad96c9a48df20cf4693091b

  • SHA512

    6b8ef32a48ca16c1401a5b10a4d9a923c128e2a46ff51643f052eb085e925fadfc984dff13a5d6cc20339ee5208dbb4b11be57688f7387263ecc5405b140891e

Score
1/10

Malware Config

Signatures

  • Checks whether UAC is enabled 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 71 IoCs
    adwarespyware
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-09-Ursnif-DLL-example-02-of-10.bin.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3656
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\2020-07-09-Ursnif-DLL-example-02-of-10.bin.dll,#1
      2⤵
        PID:3768
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:3508
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3508 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3912
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:3704
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3704 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3024
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:3060
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1528
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      PID:528
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:528 CREDAT:82945 /prefetch:2
        2⤵
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2204

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads