Analysis
-
max time kernel
196s -
max time network
212s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:30
General
-
Target
d3a71099b6d0b86fb3e477d089273c2867c3ce02094077103218a1d1db55a2f7.dll
-
Size
105KB
-
MD5
3643a3eca3c593449f6b3e1afa409b0c
-
SHA1
0a9c611d55826f162c9345a7613d39dd827ec093
-
SHA256
d3a71099b6d0b86fb3e477d089273c2867c3ce02094077103218a1d1db55a2f7
-
SHA512
ab0c6bb6b42afe53a8187982e839d8a42b94bc61d290b00eeacfa60e704b1c28d627ad3b0c6cf7f8fa0977e02a5621b87caa4951eccbec915b342e07659011d5
-
SSDEEP
1536:u3oHD1O240XJ85tDJFYjJvuzXd8AVJbaWq6dxSwUty7mQMLsfW1Vh3i1HVS7Fc6p:u3SB4KJ8bDJFygTd8I22bUty77P7dG7
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 32 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3a71099b6d0b86fb3e477d089273c2867c3ce02094077103218a1d1db55a2f7.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3a71099b6d0b86fb3e477d089273c2867c3ce02094077103218a1d1db55a2f7.dll,#13⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData4⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
-
Filesize
104KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB