95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f

Resubmissions

27/10/2022, 16:10

221027-tmnszscfh610

13/04/2022, 09:32

220413-lhmfcsahbk8

Analysis

max time kernel
82s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IconCacheService.dll
Size 248KB
Sample221027-tmnszscfh6
SHA256 95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f
MD5 e031c9984f65a9060ec1e70fbb84746b
SHA1 b01950ed9b1929fee04a9c23ac49e3de89e37228
SHA512 5dd1f004516b9fc0f0c36bca22dafaed9103191ebeea291e8d6f32f9b01b77fb18a0c4c5d04bd760a38651380a3680ede8b07f3d522f710b3df228ac8d934a2b
SSDEEP 6144:Gv77pPt5CRJRYHdhtxESU6FmixSG8aKUBYA/D1Q:GvX5C/qdhMZpG8a2A5Q
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	3452	rundll32.exe
6	3452	rundll32.exe
17	3452	rundll32.exe
38	3452	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UserSettingsVersionSVC = "C:\\Windows\\System32\\rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\IconCacheService.dll\",IconCacheDBService"	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IconCacheService.dll,#1
1⤵
- Blocklisted process makes network request
- Adds Run key to start application
PID:3452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3452-132-0x00007FF8E9F10000-0x00007FF8EA105000-memory.dmp

Download

memory/3452-133-0x00007FF8E9F10000-0x00007FF8EA105000-memory.dmp

Download

memory/3452-134-0x00007FF8E9F10000-0x00007FF8EA105000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads