bd2c1b86de45c3e9d0d7c85322228c3512ce2c041765d95bb613cdf12647bea9

Analysis

max time kernel
4265060s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
14/01/2022, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61308ba77d051e4e76e532f9709635e0.dll
Size 574KB
Sample220114-w4y2dshge5
SHA256 bd2c1b86de45c3e9d0d7c85322228c3512ce2c041765d95bb613cdf12647bea9
MD5 61308ba77d051e4e76e532f9709635e0
SHA1 95d2cd6c7be346d29735ed970d3f373d37b7e13f
SHA512 2baf01ad017b6e5f2940398b8866aed84daa66a069e29e77ecad4dadf4854b206e14e1e8175f59c26f7d6d5a17ea1b2f4e258595d8a33fd4e8675898c576c618
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1452	MusNotification.exe
Token: SeCreatePagefilePrivilege	1452	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 2288	3528	regsvr32.exe	54
PID 3528 wrote to memory of 2288	3528	regsvr32.exe	54
PID 3528 wrote to memory of 2288	3528	regsvr32.exe	54
PID 2288 wrote to memory of 2880	2288	regsvr32.exe	55
PID 2288 wrote to memory of 2880	2288	regsvr32.exe	55
PID 2288 wrote to memory of 2880	2288	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\61308ba77d051e4e76e532f9709635e0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\61308ba77d051e4e76e532f9709635e0.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\61308ba77d051e4e76e532f9709635e0.dll",DllRegisterServer
    3⤵
    PID:2880

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2288-132-0x0000000004825000-0x0000000004826000-memory.dmp

Download

memory/2288-131-0x0000000004801000-0x0000000004825000-memory.dmp