Resubmissions

27-10-2022 16:10

221027-tmnszscfh6 10

13-04-2022 09:32

220413-lhmfcsahbk 8

Analysis

  • max time kernel
    82s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-10-2022 16:10

General

  • Target

    IconCacheService.dll

  • Size

    248KB

  • MD5

    e031c9984f65a9060ec1e70fbb84746b

  • SHA1

    b01950ed9b1929fee04a9c23ac49e3de89e37228

  • SHA256

    95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f

  • SHA512

    5dd1f004516b9fc0f0c36bca22dafaed9103191ebeea291e8d6f32f9b01b77fb18a0c4c5d04bd760a38651380a3680ede8b07f3d522f710b3df228ac8d934a2b

  • SSDEEP

    6144:Gv77pPt5CRJRYHdhtxESU6FmixSG8aKUBYA/D1Q:GvX5C/qdhMZpG8a2A5Q

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\IconCacheService.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Adds Run key to start application
    PID:3452

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3452-132-0x00007FF8E9F10000-0x00007FF8EA105000-memory.dmp
    Filesize

    2.0MB

  • memory/3452-133-0x00007FF8E9F10000-0x00007FF8EA105000-memory.dmp
    Filesize

    2.0MB

  • memory/3452-134-0x00007FF8E9F10000-0x00007FF8EA105000-memory.dmp
    Filesize

    2.0MB