Analysis
-
max time kernel
149s -
max time network
2s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2022 01:23
Static task
static1
Behavioral task
behavioral1
Sample
Details.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Details.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
disallowable/lavatory.dll
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral4
Sample
disallowable/lavatory.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
disallowable/leggings.cmd
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
disallowable/leggings.cmd
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
disallowable/lavatory.dll
-
Size
422KB
-
MD5
44dc7cee0491d88c106a03ba4a147b3a
-
SHA1
b192eb80bcc6bc68689f7eaca2f22bceaca05a26
-
SHA256
cc816cb9b0bc626a5c5c7dd9143565b31edd1458ee67a4d6e89dcc640679f871
-
SHA512
f2e04b214b1acc8ca03cdaf7fc8d4941ccd9b0d57ecae256401f4277f8b450104098367cb3f8f152ea394a3515cbd70f4f994f910891bb3965a28fd367125002
-
SSDEEP
12288:eqdD/sblafl4M/8toGXJZ6diNjNo8Ywr6t57AKC:eqdclafl4eGXuiNq8Ye6c
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 regsvr32.exe 3204 regsvr32.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe 3976 wermgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3204 regsvr32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3204 2980 regsvr32.exe 77 PID 2980 wrote to memory of 3204 2980 regsvr32.exe 77 PID 2980 wrote to memory of 3204 2980 regsvr32.exe 77 PID 3204 wrote to memory of 3976 3204 regsvr32.exe 78 PID 3204 wrote to memory of 3976 3204 regsvr32.exe 78 PID 3204 wrote to memory of 3976 3204 regsvr32.exe 78 PID 3204 wrote to memory of 3976 3204 regsvr32.exe 78 PID 3204 wrote to memory of 3976 3204 regsvr32.exe 78
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\disallowable\lavatory.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\disallowable\lavatory.dll2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3976
-
-