Analysis

  • max time kernel
    136s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 04:53

General

  • Target

    7b06062372121380aca639a8d17b2a4e2e5f7f856dabb7144cb6305807250715.dll

  • Size

    208KB

  • MD5

    641047a686acc9d7a47b1fd0af39f2d0

  • SHA1

    8d471a8ed8d1a64c9b97d02b6a5b957a7780277f

  • SHA256

    7b06062372121380aca639a8d17b2a4e2e5f7f856dabb7144cb6305807250715

  • SHA512

    5d4e5b35864506f3c9ed8b7851cb873398fa13195df24850ee4dbaf162086e50bd5460bcd6e3bff2ce9e16e7f4c1df60e42db66ced7a7c529f53f5e8f07bb58d

  • SSDEEP

    3072:uHfKj5SssNrNqZIitP2Siy8uZV0wp7IkjmjB+qYBakN+gK9Rv3Tp2Bg:u/Kj5SrN/2Vx7IkjkB+qYEkogK9NoBg

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b06062372121380aca639a8d17b2a4e2e5f7f856dabb7144cb6305807250715.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b06062372121380aca639a8d17b2a4e2e5f7f856dabb7144cb6305807250715.dll,#1
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:1656
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5008
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5008 CREDAT:17410 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1520
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 636
        3⤵
        • Program crash
        PID:3520
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1568 -ip 1568
    1⤵
      PID:4908

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      471B

      MD5

      f525b778e6901e8c416e2920e4e3dc0b

      SHA1

      917ce8ae6d64bdd4dd438488176253022c57a083

      SHA256

      c9eee793aa4aa79f35d393f9f1d863483aaf4004dea6ac19bda868e92a71f8bd

      SHA512

      f6f47a4935c09769b8df316e1b459c7b153ed26ac409d4bf2ce62a1635dba4eaf7ce77de5ce83100d6f3ce7aadffed7591fb7cee7ac10a0c081a2d3c613f1ad8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      404B

      MD5

      87617352e8ad2e2ee421bf4a032e0218

      SHA1

      82a58a1c4ee019a16c98c3929826d59d97a90abb

      SHA256

      3771f58a9625c641bff2775ed2d4b9726e729fbe593a7bcf66e9136085dd6221

      SHA512

      64b8d441c77bb2198516f45b9548e92b3982b71fe17633ff34af78575c83baa100c17a9b62e47c0a5003c36cceff5ba07494b8fd87aa6a2605f939f8b643fa1e

    • C:\Windows\SysWOW64\rundll32mgr.exe

      Filesize

      88KB

      MD5

      a61ea5f2325332c52bff5bce3d161336

      SHA1

      3a883b8241f5f2efaa76367240db800d78a0209c

      SHA256

      e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b

      SHA512

      fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5

    • C:\Windows\SysWOW64\rundll32mgr.exe

      Filesize

      88KB

      MD5

      a61ea5f2325332c52bff5bce3d161336

      SHA1

      3a883b8241f5f2efaa76367240db800d78a0209c

      SHA256

      e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b

      SHA512

      fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5

    • memory/1568-133-0x0000000010000000-0x0000000010035000-memory.dmp

      Filesize

      212KB

    • memory/1568-143-0x0000000010000000-0x0000000010035000-memory.dmp

      Filesize

      212KB

    • memory/1656-137-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/1656-140-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/1656-141-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/1656-142-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB