Analysis
-
max time kernel
76s -
max time network
110s -
platform
windows10_x64 -
resource
win10 -
submitted
28-08-2020 05:00
Static task
static1
Behavioral task
behavioral1
Sample
updateme.dll
Resource
win7v200722
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
updateme.dll
Resource
win10
0 signatures
0 seconds
General
-
Target
updateme.dll
-
Size
157KB
-
MD5
c182f4b04f4c0b361c0792f9e75621b2
-
SHA1
4026c3deb1203f6ee5afed71233b888e6f9b393a
-
SHA256
b866a18458d22f3c362eb9db308ccbbe80ad1a1ef04d9f1c8ba6d3c66ccd4971
-
SHA512
f97ef84dea027e4b9b68c10f1eb599545f8d742698c5a85352460993ec080a14a80b345328c3511e937d7e9797a447b0f47b03b7cb87094ee63788d159a9f2ac
Score
10/10
Malware Config
Signatures
-
Blacklisted process makes network request 2 IoCs
Processes:
msiexec.exeflow pid process 10 960 msiexec.exe 11 960 msiexec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Apuzwei = "regsvr32.exe /s C:\\Users\\Admin\\AppData\\Roaming\\Ryna\\sotaqus.dll" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1008 set thread context of 960 1008 rundll32.exe msiexec.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 3bae1c9bf87cd601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
svchost.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 912 svchost.exe Token: SeCreatePagefilePrivilege 912 svchost.exe Token: SeSecurityPrivilege 960 msiexec.exe Token: SeSecurityPrivilege 960 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 3672 wrote to memory of 1008 3672 rundll32.exe rundll32.exe PID 3672 wrote to memory of 1008 3672 rundll32.exe rundll32.exe PID 3672 wrote to memory of 1008 3672 rundll32.exe rundll32.exe PID 1008 wrote to memory of 960 1008 rundll32.exe msiexec.exe PID 1008 wrote to memory of 960 1008 rundll32.exe msiexec.exe PID 1008 wrote to memory of 960 1008 rundll32.exe msiexec.exe PID 1008 wrote to memory of 960 1008 rundll32.exe msiexec.exe PID 1008 wrote to memory of 960 1008 rundll32.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\updateme.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\updateme.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Blacklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken