Analysis
-
max time kernel
140s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 19:40
Static task
static1
Behavioral task
behavioral1
Sample
1215b3ff9a131f20d61a10153d89a86b98935ded2f0a32efdc948dc6b530fc98.dll
Resource
win7-20221111-en
General
-
Target
1215b3ff9a131f20d61a10153d89a86b98935ded2f0a32efdc948dc6b530fc98.dll
-
Size
298KB
-
MD5
c290492d7a50c57952e53fb9933bd979
-
SHA1
6d1cd31beedd962f966b4fbbbd8f595d1cf91aef
-
SHA256
1215b3ff9a131f20d61a10153d89a86b98935ded2f0a32efdc948dc6b530fc98
-
SHA512
6c640bae331a3e6f4b4b87bc9ad89974b830967a4567d24bf90663fab6abc4e48d6bb04c307adf8d8a25938de44702bd81137a18f3929b6a94986783c879f6ca
-
SSDEEP
6144:WxGMku94XCzTurXzURlbDC9K69u2m+SqOWcsQQKiY4leDDGoggH/VREG6j4Gm01b:WxGCOXzURlbDC9K69u2m+SqOWcsQQKiD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32mgr.exepid process 512 rundll32mgr.exe -
Processes:
resource yara_rule behavioral2/memory/512-138-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral2/memory/512-139-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral2/memory/512-140-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/512-141-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/512-142-0x0000000000400000-0x0000000000419000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4360 4248 WerFault.exe rundll32.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3847207838" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999395" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999395" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3847207838" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376430501" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1097816C-6F57-11ED-B696-466E527D41B2} = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
rundll32mgr.exepid process 512 rundll32mgr.exe 512 rundll32mgr.exe 512 rundll32mgr.exe 512 rundll32mgr.exe 512 rundll32mgr.exe 512 rundll32mgr.exe 512 rundll32mgr.exe 512 rundll32mgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4916 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32mgr.exedescription pid process Token: SeDebugPrivilege 512 rundll32mgr.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4916 iexplore.exe 4916 iexplore.exe 1548 IEXPLORE.EXE 1548 IEXPLORE.EXE 1548 IEXPLORE.EXE 1548 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
rundll32mgr.exepid process 512 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exeiexplore.exedescription pid process target process PID 2620 wrote to memory of 4248 2620 rundll32.exe rundll32.exe PID 2620 wrote to memory of 4248 2620 rundll32.exe rundll32.exe PID 2620 wrote to memory of 4248 2620 rundll32.exe rundll32.exe PID 4248 wrote to memory of 512 4248 rundll32.exe rundll32mgr.exe PID 4248 wrote to memory of 512 4248 rundll32.exe rundll32mgr.exe PID 4248 wrote to memory of 512 4248 rundll32.exe rundll32mgr.exe PID 512 wrote to memory of 4916 512 rundll32mgr.exe iexplore.exe PID 512 wrote to memory of 4916 512 rundll32mgr.exe iexplore.exe PID 4916 wrote to memory of 1548 4916 iexplore.exe IEXPLORE.EXE PID 4916 wrote to memory of 1548 4916 iexplore.exe IEXPLORE.EXE PID 4916 wrote to memory of 1548 4916 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1215b3ff9a131f20d61a10153d89a86b98935ded2f0a32efdc948dc6b530fc98.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1215b3ff9a131f20d61a10153d89a86b98935ded2f0a32efdc948dc6b530fc98.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4916 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 6403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4248 -ip 42481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
85KB
MD5b4e5d5a3e41418d74e32471ee3200155
SHA1fb0f3af51e7d079c58ea4774096e659b7b188b9c
SHA256084d25d03f99b468eb590ae972af19944625512cdbddc03fd999685b1fdb959d
SHA512b773b2da0c695bc592b3870ddb4d3d0c42c00aaae73dd4a668819fcd8968d87394bc4e6e4b4bb990f3303539a310722beb9fcf7e86d08019ea4c63c9c4d22165
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
85KB
MD5b4e5d5a3e41418d74e32471ee3200155
SHA1fb0f3af51e7d079c58ea4774096e659b7b188b9c
SHA256084d25d03f99b468eb590ae972af19944625512cdbddc03fd999685b1fdb959d
SHA512b773b2da0c695bc592b3870ddb4d3d0c42c00aaae73dd4a668819fcd8968d87394bc4e6e4b4bb990f3303539a310722beb9fcf7e86d08019ea4c63c9c4d22165
-
memory/512-134-0x0000000000000000-mapping.dmp
-
memory/512-137-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/512-138-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/512-139-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/512-140-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/512-141-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/512-142-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/4248-132-0x0000000000000000-mapping.dmp
-
memory/4248-133-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB
-
memory/4248-143-0x0000000010000000-0x0000000010051000-memory.dmpFilesize
324KB