95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f

Resubmissions

27-10-2022 16:10

221027-tmnszscfh6 10

13-04-2022 09:32

220413-lhmfcsahbk 8

Analysis

max time kernel
82s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2022 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IconCacheService.dll
Size

248KB
MD5

e031c9984f65a9060ec1e70fbb84746b
SHA1

b01950ed9b1929fee04a9c23ac49e3de89e37228
SHA256

95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f
SHA512

5dd1f004516b9fc0f0c36bca22dafaed9103191ebeea291e8d6f32f9b01b77fb18a0c4c5d04bd760a38651380a3680ede8b07f3d522f710b3df228ac8d934a2b
SSDEEP

6144:Gv77pPt5CRJRYHdhtxESU6FmixSG8aKUBYA/D1Q:GvX5C/qdhMZpG8a2A5Q

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

2 3452 rundll32.exe
6 3452 rundll32.exe
17 3452 rundll32.exe
38 3452 rundll32.exe

flow	pid	process
2	3452	rundll32.exe
6	3452	rundll32.exe
17	3452	rundll32.exe
38	3452	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UserSettingsVersionSVC = "C:\\Windows\\System32\\rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\IconCacheService.dll\",IconCacheDBService"	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IconCacheService.dll,#1
1⤵
- Blocklisted process makes network request
- Adds Run key to start application
PID:3452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3452-132-0x00007FF8E9F10000-0x00007FF8EA105000-memory.dmp

Filesize
2.0MB

Download
memory/3452-133-0x00007FF8E9F10000-0x00007FF8EA105000-memory.dmp

Filesize
2.0MB

Download
memory/3452-134-0x00007FF8E9F10000-0x00007FF8EA105000-memory.dmp

Filesize
2.0MB

Download