c1a60b9e2f64753595a792c3f4dd545ea02858906b4211b68db6da0ea4449294 | Triage

Analysis

max time kernel
123s
max time network
12s
platform
windows7_x64
resource
win7v20210408
submitted
03-08-2021 19:17

Sharing

Report Analysis Logs

General

Target

0d6a10df6eeb1dbb88b4d625873ed13daa367e165374a72daa16170af3ee31a0.dll
Size

299KB
MD5

d9a7c058d91a93047e925c8e2f37dcc0
SHA1

4cd12b4fd8ddc3dad8c515c2e01fe71f0736cfa2
SHA256

0d6a10df6eeb1dbb88b4d625873ed13daa367e165374a72daa16170af3ee31a0
SHA512

8cc311cb0c90781fcebd50370746bfdb7f58747c4b76341c86a88ee3ee9fe54a45abf02618c747a3dbe937536a628997a601f1b283658fc251a8f202d3887b10

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\rundll32.exe: $TASK	rundll32.exe
File opened for modification	C:\Windows\system32\rundll32.exe: $FILE	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1296	taskeng.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 760	1296	taskeng.exe	30
PID 1296 wrote to memory of 760	1296	taskeng.exe	30
PID 1296 wrote to memory of 760	1296	taskeng.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d6a10df6eeb1dbb88b4d625873ed13daa367e165374a72daa16170af3ee31a0.dll,#1
1⤵
- Drops file in System32 directory
PID:360

C:\Windows\system32\taskeng.exe
taskeng.exe {BE13E0F2-6B9C-4EA6-A154-4AE0F82B0BD0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe -u
  2⤵
  PID:760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads