02548db32d3bba029d65fb0d6021bbb8dc9aa787c78d2b191d0c867102e846af

Analysis

max time kernel
15s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2022 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

iUjs]pƹuΫ X-Mouse Button Control K��.dll
Size

301KB
MD5

6eeef71b3203e8815614c057fbd6da49
SHA1

0223be8f1f589cee5f44d98ea2581acd05ab2b1a
SHA256

de76e04597d2e937807ffd44f744d15733b85b6679a7d96d5d634c6386cfab71
SHA512

ea73294364fcac57137e9a8ee7e7fb9bd4f8995ad08525dafac343d70b9daf836a3af694cc7797e80a6fef6becd0c58529b1295aed8f46482c78a7d0220216be
SSDEEP

6144:CQBbhIMIfMttz0eNrSyGpomHvVgWAQGiUUYVurwgiCnPK+ETB59RB:CibhA+tz0eNrSyGpomHvqWZGsYVGZnPM

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

4484 rundll32.exe
4484 rundll32.exe

pid	process
4484	rundll32.exe
4484	rundll32.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

rundll32.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4484	rundll32.exe
Token: SeSecurityPrivilege	4484	rundll32.exe
Token: SeTakeOwnershipPrivilege	4484	rundll32.exe
Token: SeLoadDriverPrivilege	4484	rundll32.exe
Token: SeSystemProfilePrivilege	4484	rundll32.exe
Token: SeSystemtimePrivilege	4484	rundll32.exe
Token: SeProfSingleProcessPrivilege	4484	rundll32.exe
Token: SeIncBasePriorityPrivilege	4484	rundll32.exe
Token: SeCreatePagefilePrivilege	4484	rundll32.exe
Token: SeBackupPrivilege	4484	rundll32.exe
Token: SeRestorePrivilege	4484	rundll32.exe
Token: SeShutdownPrivilege	4484	rundll32.exe
Token: SeDebugPrivilege	4484	rundll32.exe
Token: SeSystemEnvironmentPrivilege	4484	rundll32.exe
Token: SeRemoteShutdownPrivilege	4484	rundll32.exe
Token: SeUndockPrivilege	4484	rundll32.exe
Token: SeManageVolumePrivilege	4484	rundll32.exe
Token: 33	4484	rundll32.exe
Token: 34	4484	rundll32.exe
Token: 35	4484	rundll32.exe
Token: 36	4484	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2076 wrote to memory of 4484	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 4484	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 4484	2076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\iUjs]pƹuΫ X-Mouse Button Control K��.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\iUjs]pƹuΫ X-Mouse Button Control K��.dll",#1
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4484-132-0x0000000000000000-mapping.dmp

Download