Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 09:22

General

  • Target

    18fde4891144408616c44453363523a5bc6a15c53d3bc110495ba63cd953d6c8.dll

  • Size

    460KB

  • MD5

    beae4d36b224b8a1ee61e4f9dc4151cf

  • SHA1

    2780fc238cd0eb2d10eefa8bb639f6c589123984

  • SHA256

    18fde4891144408616c44453363523a5bc6a15c53d3bc110495ba63cd953d6c8

  • SHA512

    ae80e3a12379de68707f7f60c653af8ea73910d259cd326c5ef2b118f441c7604016786c7dbdbb26f5ab2ca68998c8f3389354e07eee90539e323902fccd5a9e

  • SSDEEP

    6144:uyolGpyTm5X7UKCns9rsKGLNW1opnmavXwlkJBgl0GQOeHvCpnVVjX7WKMYuEmw:ul4yMvINxMiFvwl03FHETjX7MY5mw

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\18fde4891144408616c44453363523a5bc6a15c53d3bc110495ba63cd953d6c8.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\18fde4891144408616c44453363523a5bc6a15c53d3bc110495ba63cd953d6c8.dll,#1
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetWindowsHookEx
      PID:1044
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:1588
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4708
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4708 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3252
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4708 CREDAT:82948 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4204

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      471B

      MD5

      a66314123c8c72372bcb8583a5400a95

      SHA1

      fc3e45060463c37775da0bd4a8920296d222753d

      SHA256

      657c92d95798fc5dad4272f3d6d71776737ac0bcdce4ac6864ca5532f2ccf34d

      SHA512

      d9f5c243b04d7b3fbbcb37c68c583db672390644500cfa4d58280048d9fde52c668fd67e84ecd6ace20b2813eefb756627adbd04a6f19719f6e907aa3fffe4f1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      434B

      MD5

      317e5c16d4e3d8c8346b8e6ed01264b6

      SHA1

      ef28f969875d03aeef888ec4a9cb577a43308a0c

      SHA256

      59a7a4bf49c2400c1adac26e2f43ba7c2b239f77b05440f0915fa47730ded083

      SHA512

      1e1cc43f388852f2592003c7a9918e4406f2a9243007982da43ed452da2f945100347435db56b164b5f6e848e915f8d950ea42d6fb08c2f289b60fdfff9f90f7

    • memory/1044-133-0x0000000001510000-0x0000000001586000-memory.dmp

      Filesize

      472KB

    • memory/1044-137-0x00000000014A0000-0x0000000001505000-memory.dmp

      Filesize

      404KB