c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d

Analysis

max time kernel
90s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2022, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe
Size

14KB
MD5

04d2a99c2d96991c61a02eb7adf74e22
SHA1

a20400f0d8eaae0f4af0e3c78cdd85d7225531d4
SHA256

c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d
SHA512

7627c29e9c82b63fbf5392ce164071c32d53fd7573fb12d336b814873ebfa5dd410272e873531e1df7175ea236bed78f5bf9d454686d641a1c2b53d4a958d0c2
SSDEEP

192:r40PmcsbuT3Pj7TTEg81TIshoKRInzOnPJnwK7S0a7mtpE8DKlmkdsuVRLzLvbIb:rzOqPnEg8EKRGen/73BpMJsuDLzDbIy4

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ddyhrucr.dll = "{D1CC9DC6-F0BC-40fc-9552-E497B05E05B8}"	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe

Loads dropped DLL 1 IoCs

pid	Process
2296	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ddyhrucr.tmp	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe
File opened for modification	C:\Windows\SysWOW64\ddyhrucr.tmp	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe
File opened for modification	C:\Windows\SysWOW64\ddyhrucr.nls	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1CC9DC6-F0BC-40fc-9552-E497B05E05B8}	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1CC9DC6-F0BC-40fc-9552-E497B05E05B8}\InProcServer32	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1CC9DC6-F0BC-40fc-9552-E497B05E05B8}\InProcServer32\ = "C:\\Windows\\SysWow64\\ddyhrucr.dll"	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1CC9DC6-F0BC-40fc-9552-E497B05E05B8}\InProcServer32\ThreadingModel = "Apartment"	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2296	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe
2296	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2296	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe
2296	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe
2296	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 5060	2296	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe	85
PID 2296 wrote to memory of 5060	2296	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe	85
PID 2296 wrote to memory of 5060	2296	c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe	85

C:\Users\Admin\AppData\Local\Temp\c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe
"C:\Users\Admin\AppData\Local\Temp\c630da93be44c4ba6e32bfe0571e195ec6afa9083c80cff431bc1a0ddcf41e0d.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\7995.tmp.bat
  2⤵
  PID:5060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7995.tmp.bat

Filesize
243B

MD5
7d5811e7e0427b81eecf08b5bca72691

SHA1
755372243699f112bc77a0077744ec7d3e646ed4

SHA256
9de210bfa6a6092803a5163d453c2194a95ec042b15eea61ec68342e8496155f

SHA512
b004ed8dca667f85b128d5fb0efa73ed6a37704866c8e8cbb5f5c612f8f5dfdf60d86b6a235ab82d24f3efe786c276371cb1d187fc5bf8cd05e8b75eb2bdd241

Download Submit
C:\Windows\SysWOW64\ddyhrucr.dll

Filesize
2.1MB

MD5
ebbd65b223bcc0b5637bcd445215333c

SHA1
c5872af6d62ac813bd322535190090ae0e4037e7

SHA256
ac37ddb5ea7abfbce66d04bf8dc5f41ab1bede7a94c30e9f4002df4f32647755

SHA512
eb6ef5f09e0598601deb4cd55823701003d9926200c23e494b98c75166eaad09bd4c332ba6a87ab60f14c0c508f3c2c00d6e147d53d70ea608f01e88f81547f2

Download Submit