d303ec837c5f96fa4f52abd3f87a7ae066092d298cc4a69a8a8cc3f35970a1f9

Analysis

max time kernel
4265067s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
17/01/2022, 22:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
909e25cff8796013c5b3edb6874fb0b5.dll
Size 479KB
Sample220117-12s5ksdaf7
SHA256 d303ec837c5f96fa4f52abd3f87a7ae066092d298cc4a69a8a8cc3f35970a1f9
MD5 909e25cff8796013c5b3edb6874fb0b5
SHA1 76dca4ee7ccf031fc03a7cec5b376d3b0ae3470e
SHA512 7bbfceaa7e8515130ab984eb8addfd8c40f1ccde8c32d5817d7a41e4bbaadac2765d9376b6526ebdab76088eadd8ad76a5007f7224dd6d56106ca9a823c883a4
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1920	MusNotification.exe
Token: SeCreatePagefilePrivilege	1920	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 3576	1068	regsvr32.exe	54
PID 1068 wrote to memory of 3576	1068	regsvr32.exe	54
PID 1068 wrote to memory of 3576	1068	regsvr32.exe	54
PID 3576 wrote to memory of 3544	3576	regsvr32.exe	55
PID 3576 wrote to memory of 3544	3576	regsvr32.exe	55
PID 3576 wrote to memory of 3544	3576	regsvr32.exe	55

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\909e25cff8796013c5b3edb6874fb0b5.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\909e25cff8796013c5b3edb6874fb0b5.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\909e25cff8796013c5b3edb6874fb0b5.dll",DllRegisterServer
    3⤵
    PID:3544

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3576-132-0x00000000043F5000-0x00000000043F6000-memory.dmp

Download

memory/3576-131-0x00000000043D1000-0x00000000043F5000-memory.dmp