Analysis

  • max time kernel
    157s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    01-02-2022 10:55

General

  • Target

    0f636ca98aab74539b06036f03e10f69d658803a3f180b8f5897e972aa626102.dll

  • Size

    109KB

  • MD5

    d04d2a5f304cc7a6c3583e65c4cefead

  • SHA1

    b58c136b8ca58a4f3dbfd72154756dfd041d1315

  • SHA256

    0f636ca98aab74539b06036f03e10f69d658803a3f180b8f5897e972aa626102

  • SHA512

    62f0f2939235e4fac5c9af7ba3d686837b305714026d802a07cd6a5ce0d97f83042b5c006232dac19d4eebb7e6c8007c1ad6bb12b8d10d1ad42f2906a21d08dc

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0f636ca98aab74539b06036f03e10f69d658803a3f180b8f5897e972aa626102.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\0f636ca98aab74539b06036f03e10f69d658803a3f180b8f5897e972aa626102.dll
      2⤵
        PID:2464
    • C:\Windows\System32\WaaSMedicAgent.exe
      C:\Windows\System32\WaaSMedicAgent.exe 1926f5e92013ebb408f34290652628ea ICnGkqs/gU+sTicfu9aFkA.0.1.0.0.0
      1⤵
      • Modifies data under HKEY_USERS
      PID:4084
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:3192
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4016
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
        1⤵
          PID:3320

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Defense Evasion

        Modify Registry

        2
        T1112

        Replay Monitor

        Loading Replay Monitor...

        Downloads