db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f

Analysis

max time kernel
92s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe
Size

112KB
MD5

f2f06c7759f4c358b23c8ac715e84f29
SHA1

4503a3f34c5a5f4b5315a1dea18f6802143ccdb3
SHA256

db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f
SHA512

6a2087e6c64f3abcfa2c09adfac03bb7e71093f5755e1451c2e988ef61776f74b2c4167982b4caa6993016a80494fdd0dc00a7afb73e54af075c99897cb1074d
SSDEEP

3072:IX3mfj1USDsTPYvQG+iIunxeMHrIPbzm7p:tr1U6iP8D+FunTHrInm7

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility32.dll"	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe

Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

1528 svchost.exe
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 4.2.2.1

pid	process
1528	svchost.exe

description	ioc
Destination IP	4.2.2.1

Drops file in System32 directory 2 IoCs

Processes:

db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility32.dll	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe
File created	C:\Windows\SysWOW64\FastUserSwitchingCompatibility32.dll	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe

description	pid	process	target process
PID 4512 wrote to memory of 4444	4512	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe	cmd.exe
PID 4512 wrote to memory of 4444	4512	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe	cmd.exe
PID 4512 wrote to memory of 4444	4512	db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe
"C:\Users\Admin\AppData\Local\Temp\db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\db71315d52651089b89fa615d0e409cf87ec2dcd4e32abd39a6e37705dd5730f.exe"
2⤵
PID:4444

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\FastUserSwitchingCompatibility32.dll

Filesize
15KB

MD5
90c3324ee5258ef30c57d2c7e0917e58

SHA1
9eb705424bb71be04cf0eda9230ebc3c45f3ea69

SHA256
f98776a50836d5e8acfde7028730f91cb49c2b5f42aef1053d433a79c3220144

SHA512
7dba4dcd7aa182c8c639307c45af0a6e5637de85573da2f29f28d0fab55492dcf9e95318a7002c80b4faf33ab1b74af5b393e81eff94b6d0f5f19150ff9b5143

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility32.dll

Filesize
15KB

MD5
90c3324ee5258ef30c57d2c7e0917e58

SHA1
9eb705424bb71be04cf0eda9230ebc3c45f3ea69

SHA256
f98776a50836d5e8acfde7028730f91cb49c2b5f42aef1053d433a79c3220144

SHA512
7dba4dcd7aa182c8c639307c45af0a6e5637de85573da2f29f28d0fab55492dcf9e95318a7002c80b4faf33ab1b74af5b393e81eff94b6d0f5f19150ff9b5143

Download Submit
memory/1528-137-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/1528-138-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4444-139-0x0000000000000000-mapping.dmp

Download
memory/4512-132-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4512-134-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4512-133-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4512-140-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download