Analysis

  • max time kernel
    118s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    01-02-2022 09:09

General

  • Target

    d3732cfb3cf320fbafcd332dcf4db90b5d306bf4e16518248a571124599e07cb.dll

  • Size

    42KB

  • MD5

    e925c5008b817fab066c50aad00eadfb

  • SHA1

    8b160a12a9709770bdea5a527bb7d1f209c26f1a

  • SHA256

    d3732cfb3cf320fbafcd332dcf4db90b5d306bf4e16518248a571124599e07cb

  • SHA512

    3123db29fbe8a9150aa84a46a9b6cbf7e2dc5e85339facbd5d666ce4cd58e2dea0abf1aff57bd3b3023a210405c17e322e1dfead79da1693e4aec618d6b8e732

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs
  • Drops file in Windows directory 6 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3732cfb3cf320fbafcd332dcf4db90b5d306bf4e16518248a571124599e07cb.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3292
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3732cfb3cf320fbafcd332dcf4db90b5d306bf4e16518248a571124599e07cb.dll,#1
      2⤵
        PID:1440
    • C:\Windows\System32\WaaSMedicAgent.exe
      C:\Windows\System32\WaaSMedicAgent.exe d6a1d9cd8b67b335c452676176f3e191 rkfjP2ZVM0uymNcjQ7jgfQ.0.1.0.0.0
      1⤵
      • Modifies data under HKEY_USERS
      PID:1516
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2920

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2920-130-0x000002AF28D30000-0x000002AF28D40000-memory.dmp
      Filesize

      64KB

    • memory/2920-131-0x000002AF28D90000-0x000002AF28DA0000-memory.dmp
      Filesize

      64KB

    • memory/2920-132-0x000002AF2BAA0000-0x000002AF2BAA4000-memory.dmp
      Filesize

      16KB