8baffba2ed672607e1535dcbfcc47a264e7b8941f63cf181814d7365e8627d05 | Triage

Resubmissions

04-02-2021 16:58

210204-qx2mdjj6ce 1

22-01-2021 09:16

210122-vtr8qktyhx 10

Analysis

max time kernel
44s
max time network
45s
platform
windows7_x64
resource
win7v20201028
submitted
22-01-2021 09:16

Sharing

Report Analysis Logs

General

Target

pan0ramic0.jpg.dll
Size

220KB
MD5

86b877eeaf0482b5e1439ed80a82fffb
SHA1

26c46504c293311f0403bf699f2ddc6cacb63c5b
SHA256

8baffba2ed672607e1535dcbfcc47a264e7b8941f63cf181814d7365e8627d05
SHA512

668d14788dea6baa58997ee0ddc364c93d268091cc0f2b7e30a1d0b29c6389438c11d53b35d5ab40abe58efebbc92f5acdae92e0cba852cfbd970cecf0e53dd5

Score

1^/10

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 76 IoCs

Processes:

regsvr32.exe

pid	process
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe
1488	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 740 wrote to memory of 1488	740	regsvr32.exe	regsvr32.exe
PID 740 wrote to memory of 1488	740	regsvr32.exe	regsvr32.exe
PID 740 wrote to memory of 1488	740	regsvr32.exe	regsvr32.exe
PID 740 wrote to memory of 1488	740	regsvr32.exe	regsvr32.exe
PID 740 wrote to memory of 1488	740	regsvr32.exe	regsvr32.exe
PID 740 wrote to memory of 1488	740	regsvr32.exe	regsvr32.exe
PID 740 wrote to memory of 1488	740	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\pan0ramic0.jpg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\pan0ramic0.jpg.dll
2⤵
- Suspicious use of FindShellTrayWindow
PID:1488

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-2-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp

Filesize
8KB

Download
memory/1488-3-0x0000000000000000-mapping.dmp

Download
memory/1488-4-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1488-5-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1488-6-0x0000000000170000-0x00000000001B4000-memory.dmp

Filesize
272KB

Download