02548db32d3bba029d65fb0d6021bbb8dc9aa787c78d2b191d0c867102e846af

Analysis

max time kernel
64s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2022 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iUjs]pƹuΫ X-Mouse Button Control K��.dll
Size

364KB
MD5

61c5b19137499097252b3ff045f58c51
SHA1

a6e09564da5610b42f291d10ea414e4b79b5731d
SHA256

cb2a47787fcda96511a434e82a07a7be03fb7733667dc1a5975b5226730565c5
SHA512

b2379c840887a4cf3c7cc98cfd1497f1d39eacb66077e4a49a55a6e2a91dc5fc068ef3feb5d59feb6717edc7c65610be49d2c07845dd4ee24e445a66fa509ef7
SSDEEP

6144:4v+VkJpn893Q9eg3rX9FudjTLNjGGtOCi5TBObX:4vfJp8pQ9eg3rX9FudjxqTk

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1360 rundll32.exe
1360 rundll32.exe

pid	process
1360	rundll32.exe
1360	rundll32.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

rundll32.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1360	rundll32.exe
Token: SeSecurityPrivilege	1360	rundll32.exe
Token: SeTakeOwnershipPrivilege	1360	rundll32.exe
Token: SeLoadDriverPrivilege	1360	rundll32.exe
Token: SeSystemProfilePrivilege	1360	rundll32.exe
Token: SeSystemtimePrivilege	1360	rundll32.exe
Token: SeProfSingleProcessPrivilege	1360	rundll32.exe
Token: SeIncBasePriorityPrivilege	1360	rundll32.exe
Token: SeCreatePagefilePrivilege	1360	rundll32.exe
Token: SeBackupPrivilege	1360	rundll32.exe
Token: SeRestorePrivilege	1360	rundll32.exe
Token: SeShutdownPrivilege	1360	rundll32.exe
Token: SeDebugPrivilege	1360	rundll32.exe
Token: SeSystemEnvironmentPrivilege	1360	rundll32.exe
Token: SeRemoteShutdownPrivilege	1360	rundll32.exe
Token: SeUndockPrivilege	1360	rundll32.exe
Token: SeManageVolumePrivilege	1360	rundll32.exe
Token: 33	1360	rundll32.exe
Token: 34	1360	rundll32.exe
Token: 35	1360	rundll32.exe
Token: 36	1360	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\iUjs]pƹuΫ X-Mouse Button Control K��.dll",#1
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads