fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885

General

Target
fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885.dll
Size 474KB
Sample211103-n869kadff9
SHA256 fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885
MD5 c861f25bb943f77a909b33d62bb71926
SHA1 576b953cb4fe71adb71a338a42524b0e424824c1
SHA512 96805ff1332bbeebc019127c8f1e31e0a311eac727ad7aa75fc6c977af965e57c05207a78de2a8b046d90b6a5c5db4f59909c2ef4a8915fe747067c28b42f000
MD5 SHA1 SHA512

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1136	regsvr32.exe

Adds Run key to start application 2 TTPs 4 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WDFSync = "regsvr32.exe /s \"C:\\ProgramData\\Software\\Microsoft\\Windows\\MDF\\WDFSync\\WDFSync.dll\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WDFSync = "regsvr32.exe /s \"C:\\ProgramData\\Software\\Microsoft\\Windows\\MDF\\WDFSync\\WDFSync.dll\""	regsvr32.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 1300	3500	regsvr32.exe	68
PID 3500 wrote to memory of 1300	3500	regsvr32.exe	68
PID 3500 wrote to memory of 484	3500	regsvr32.exe	70
PID 3500 wrote to memory of 484	3500	regsvr32.exe	70
PID 3500 wrote to memory of 1136	3500	regsvr32.exe	72
PID 3500 wrote to memory of 1136	3500	regsvr32.exe	72

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fd59597169668b90c47d0ad6db1bcd7d778c6d54ee3c42bdd2d86b2d2d34c885.dll
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\temp\FA8E.tmp.bat
  2⤵
  PID:1300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\temp\FE87.tmp.bat
  2⤵
  PID:484
- C:\Windows\system32\regsvr32.exe
  regsvr32.exe /s "C:\ProgramData\Software\Microsoft\Windows\MDF\WDFSync\WDFSync.dll"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:1136