960f02b5f7d39c4ebff61c8345c69f2f84e42d27db7442cb8a37c5df91dff07d

Analysis

max time kernel
4265069s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
17/01/2022, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f584ae0cf0fdffd42d26ad859bc2103f.dll
Size 472KB
Sample220117-mgj5aaheb9
SHA256 960f02b5f7d39c4ebff61c8345c69f2f84e42d27db7442cb8a37c5df91dff07d
MD5 f584ae0cf0fdffd42d26ad859bc2103f
SHA1 fa003fb8ddb36ac51c857aa02a2beeabd61b8576
SHA512 96a80215da1f18c04644a0cfac1569e8267306ac38eb292cc0736f95ef51659dd586329ea7ea330a1dfc8730750522f0285beedb86bcb2118ed12618d3a13caa
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1152	MusNotification.exe
Token: SeCreatePagefilePrivilege	1152	MusNotification.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 3904	1068	regsvr32.exe	54
PID 1068 wrote to memory of 3904	1068	regsvr32.exe	54
PID 1068 wrote to memory of 3904	1068	regsvr32.exe	54
PID 3904 wrote to memory of 1436	3904	regsvr32.exe	57
PID 3904 wrote to memory of 1436	3904	regsvr32.exe	57
PID 3904 wrote to memory of 1436	3904	regsvr32.exe	57

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f584ae0cf0fdffd42d26ad859bc2103f.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\f584ae0cf0fdffd42d26ad859bc2103f.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\f584ae0cf0fdffd42d26ad859bc2103f.dll",DllRegisterServer
    3⤵
    PID:1436

C:\Windows\system32\MusNotification.exe
C:\Windows\system32\MusNotification.exe
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3904-132-0x0000000004A45000-0x0000000004A46000-memory.dmp

Download

memory/3904-131-0x0000000004A21000-0x0000000004A45000-memory.dmp