7a310f67e33b25d9ccd8cd6dc9838e139530f3e26347fc91cb95973aee252af7

General

Target

7a310f67e33b25d9ccd8cd6dc9838e139530f3e26347fc91cb95973aee252af7.dll
Size

166KB
MD5

a0dcee6206b17bfcc77c7287847149e0
SHA1

dbfcc428fcae393fc33820b98dcd7122d8bde58f
SHA256

7a310f67e33b25d9ccd8cd6dc9838e139530f3e26347fc91cb95973aee252af7
SHA512

5e1d183a6e67731f8183588053495b55f69f6d98e875989a88622ababd66adb60b423eeb45e1a588c7c14a9be2cd2741c9034883d5734643269ba4cced677c6e
SSDEEP

3072:xV+QinZkSiO9Db21LUhQC/d2CDrNFqln5IqFHn5vX79uaMiyI:5iZoO9DP9zA5IMVX79uat

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

flow	pid	Process
11	5044	rundll32.exe
12	3184	rundll32.exe
36	3184	rundll32.exe
37	3184	rundll32.exe
38	5044	rundll32.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Winmgmt\Parameters\ServiceDll = "C:\\PROGRA~3\\2992199F9A\\7fa252eea37959bc19cf74362e3f035931e8389cd6dc8dcc9d52b33e76f013a7.faa"	rundll32.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3184-136-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/3184-137-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral2/memory/3184-138-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/5044-147-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/3184-148-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/3184-149-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/5044-150-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/5044-151-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
5044	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\PROGRA~3\2992199F9A\2193912002.dat	rundll32.exe
File created	C:\PROGRA~3\2992199F9A\4hia9a.bbr	rundll32.exe
File created	C:\PROGRA~3\2992199F9A\7fa252eea37959bc19cf74362e3f035931e8389cd6dc8dcc9d52b33e76f013a7Admin.fdd	rundll32.exe
File opened for modification	C:\PROGRA~3\2992199F9A\4hia9a.bbr	rundll32.exe
File created	C:\PROGRA~3\2992199F9A\4hia9aAdmin.fdd	rundll32.exe
File created	C:\PROGRA~3\2992199F9A\a9aih4.cpp	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3184	rundll32.exe
3184	rundll32.exe
5044	rundll32.exe
5044	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3184	1540	rundll32.exe	82
PID 1540 wrote to memory of 3184	1540	rundll32.exe	82
PID 1540 wrote to memory of 3184	1540	rundll32.exe	82
PID 3184 wrote to memory of 5044	3184	rundll32.exe	83
PID 3184 wrote to memory of 5044	3184	rundll32.exe	83
PID 3184 wrote to memory of 5044	3184	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a310f67e33b25d9ccd8cd6dc9838e139530f3e26347fc91cb95973aee252af7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a310f67e33b25d9ccd8cd6dc9838e139530f3e26347fc91cb95973aee252af7.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Sets DLL path for service in the registry
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3184
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\PROGRA~3\299219~1\a9aih4.cpp,work
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:5044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\299219~1\a9aih4.cpp

Filesize
166KB

MD5
a0dcee6206b17bfcc77c7287847149e0

SHA1
dbfcc428fcae393fc33820b98dcd7122d8bde58f

SHA256
7a310f67e33b25d9ccd8cd6dc9838e139530f3e26347fc91cb95973aee252af7

SHA512
5e1d183a6e67731f8183588053495b55f69f6d98e875989a88622ababd66adb60b423eeb45e1a588c7c14a9be2cd2741c9034883d5734643269ba4cced677c6e

Download Submit
C:\ProgramData\2992199F9A\a9aih4.cpp

Filesize
166KB

MD5
a0dcee6206b17bfcc77c7287847149e0

SHA1
dbfcc428fcae393fc33820b98dcd7122d8bde58f

SHA256
7a310f67e33b25d9ccd8cd6dc9838e139530f3e26347fc91cb95973aee252af7

SHA512
5e1d183a6e67731f8183588053495b55f69f6d98e875989a88622ababd66adb60b423eeb45e1a588c7c14a9be2cd2741c9034883d5734643269ba4cced677c6e

Download Submit
memory/3184-137-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3184-138-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3184-136-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3184-133-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3184-148-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3184-149-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5044-142-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5044-147-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5044-150-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5044-151-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing