Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    13-02-2022 22:33

General

  • Target

    0944f12d7f4a22a32861cc3e102aff14e3105e91f99d16e32efca811417c3bab.dll

  • Size

    196KB

  • MD5

    67ef55c53b9db71ee0288367fc7a226f

  • SHA1

    1686e2acce550535c389084adc3e37e2e3936d97

  • SHA256

    0944f12d7f4a22a32861cc3e102aff14e3105e91f99d16e32efca811417c3bab

  • SHA512

    472907cc5fa25ac8ab1ca3ed2a80985aa616f988502c0efb20b32f1fd41bb417508d77f82afc56e465621727d96de2629b7d1680e31b0204b7db3d8c450a268a

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0944f12d7f4a22a32861cc3e102aff14e3105e91f99d16e32efca811417c3bab.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4052
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0944f12d7f4a22a32861cc3e102aff14e3105e91f99d16e32efca811417c3bab.dll,#1
      2⤵
        PID:2204
    • C:\Windows\system32\MusNotifyIcon.exe
      %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
      1⤵
      • Checks processor information in registry
      PID:3588
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:640
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:924

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads