bfbad5d3ac727d2964b097e846d9c76341f93b041a6ee14931d200630444fed8

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfbad5d3ac727d2964b097e846d9c76341f93b041a6ee14931d200630444fed8.dll
Size

114KB
MD5

7a1c3edadfab1189e68f2d013337deb2
SHA1

bcc1f997656406ce20fbd3f46fe72f9737ec1027
SHA256

bfbad5d3ac727d2964b097e846d9c76341f93b041a6ee14931d200630444fed8
SHA512

fa03084611d5791e8134ffe9e3c2bd20910654d4de06907e8856a878e587a4f9bbd7cf83e8a0aa36808df3899167f3d09fdd2bcb17a41421ddb6181aab3161bc
SSDEEP

3072:IdpgMxsdSyg4TvtcMk8Lyzb8ckivlu5KniCbmN:Mpl2GkGMkSgb8Svlu5KnON

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{gtaxyz2j-2r62-z0zz-9tug-7upwx6b0c4ra}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{gtaxyz2j-2r62-z0zz-9tug-7upwx6b0c4ra}\ = "ÏµÍ³ÉèÖÃ"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{gtaxyz2j-2r62-z0zz-9tug-7upwx6b0c4ra}\stubpath = "þÿÿÿX"	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26
PID 1612 wrote to memory of 788	1612	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfbad5d3ac727d2964b097e846d9c76341f93b041a6ee14931d200630444fed8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfbad5d3ac727d2964b097e846d9c76341f93b041a6ee14931d200630444fed8.dll,#1
  2⤵
  - Modifies Installed Components in the registry
  PID:788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download