3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8

Analysis

max time kernel
152s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe
Size

111KB
MD5

07570e96ee1c4e18a319ab4b0433f049
SHA1

5f4fab89a7b394d4c183abcaf0e581535e2fb6be
SHA256

3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8
SHA512

2c36d81ffb3654f2ade28b023daffab91aeb8571134a2564fb70fcc7f6596ea4314fee2af0b0733f3fca39b93de7663757735e19873883ecf91cef5abdbcaafd
SSDEEP

3072:yg4XiTSU/cN1JoHq1KZe75QU4fHq1KZe75Q9bcXZlg8KMMiU1m9:yg4X4j/cdoHq1KZe75QhfHq1KZe75Q1b

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
1708	3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iihiggaudio = "rundll32.exe \"vtrssr.dll\",s"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bywuttaudio = "rundll32.exe \"vtrssr.dll\",s"	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vtrssr.dll	3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe
864	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe
Token: SeDebugPrivilege	864	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 864	1708	3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe	26
PID 1708 wrote to memory of 864	1708	3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe	26
PID 1708 wrote to memory of 864	1708	3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe	26
PID 1708 wrote to memory of 864	1708	3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe	26
PID 1708 wrote to memory of 864	1708	3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe	26
PID 1708 wrote to memory of 864	1708	3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe	26
PID 1708 wrote to memory of 864	1708	3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe	26
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 416	864	rundll32.exe	3
PID 864 wrote to memory of 1124	864	rundll32.exe	17
PID 864 wrote to memory of 1180	864	rundll32.exe	16
PID 864 wrote to memory of 1708	864	rundll32.exe	20
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15
PID 864 wrote to memory of 1224	864	rundll32.exe	15

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1224
- C:\Users\Admin\AppData\Local\Temp\3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe
  "C:\Users\Admin\AppData\Local\Temp\3c267fec8553ba1a604e92164f07a701cee152d3f50cbf235b9c1f2c3703fff8.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\system32\vtrssr.dll",s
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:864

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\vtrssr.dll

Filesize
111KB

MD5
feaeafbbfe472982dff9fe797f438cb3

SHA1
1fb3168ecef4e8f9d6c0371056ececb0b396fc76

SHA256
c2b54204c9793da473779c51d5712af3a116db318fd708fc041a596bbe2731dc

SHA512
cbad4e4b0070c5bc10c23953fefdbb705c0834789bfb53bdcc4139a6ee276fa661d1dd3fb13c925da5dc844abf9e8500b0982f8b96ed490225de2c95b67994fc

Download Submit
\Windows\SysWOW64\vtrssr.dll

Filesize
111KB

MD5
feaeafbbfe472982dff9fe797f438cb3

SHA1
1fb3168ecef4e8f9d6c0371056ececb0b396fc76

SHA256
c2b54204c9793da473779c51d5712af3a116db318fd708fc041a596bbe2731dc

SHA512
cbad4e4b0070c5bc10c23953fefdbb705c0834789bfb53bdcc4139a6ee276fa661d1dd3fb13c925da5dc844abf9e8500b0982f8b96ed490225de2c95b67994fc

Download Submit
\Windows\SysWOW64\vtrssr.dll

Filesize
111KB

MD5
feaeafbbfe472982dff9fe797f438cb3

SHA1
1fb3168ecef4e8f9d6c0371056ececb0b396fc76

SHA256
c2b54204c9793da473779c51d5712af3a116db318fd708fc041a596bbe2731dc

SHA512
cbad4e4b0070c5bc10c23953fefdbb705c0834789bfb53bdcc4139a6ee276fa661d1dd3fb13c925da5dc844abf9e8500b0982f8b96ed490225de2c95b67994fc

Download Submit
\Windows\SysWOW64\vtrssr.dll

Filesize
111KB

MD5
feaeafbbfe472982dff9fe797f438cb3

SHA1
1fb3168ecef4e8f9d6c0371056ececb0b396fc76

SHA256
c2b54204c9793da473779c51d5712af3a116db318fd708fc041a596bbe2731dc

SHA512
cbad4e4b0070c5bc10c23953fefdbb705c0834789bfb53bdcc4139a6ee276fa661d1dd3fb13c925da5dc844abf9e8500b0982f8b96ed490225de2c95b67994fc

Download Submit
\Windows\SysWOW64\vtrssr.dll

Filesize
111KB

MD5
feaeafbbfe472982dff9fe797f438cb3

SHA1
1fb3168ecef4e8f9d6c0371056ececb0b396fc76

SHA256
c2b54204c9793da473779c51d5712af3a116db318fd708fc041a596bbe2731dc

SHA512
cbad4e4b0070c5bc10c23953fefdbb705c0834789bfb53bdcc4139a6ee276fa661d1dd3fb13c925da5dc844abf9e8500b0982f8b96ed490225de2c95b67994fc

Download Submit
\Windows\SysWOW64\vtrssr.dll

Filesize
111KB

MD5
feaeafbbfe472982dff9fe797f438cb3

SHA1
1fb3168ecef4e8f9d6c0371056ececb0b396fc76

SHA256
c2b54204c9793da473779c51d5712af3a116db318fd708fc041a596bbe2731dc

SHA512
cbad4e4b0070c5bc10c23953fefdbb705c0834789bfb53bdcc4139a6ee276fa661d1dd3fb13c925da5dc844abf9e8500b0982f8b96ed490225de2c95b67994fc

Download Submit
memory/864-70-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/864-83-0x0000000000160000-0x0000000000167000-memory.dmp

Filesize
28KB

Download
memory/1708-64-0x0000000000220000-0x0000000000227000-memory.dmp

Filesize
28KB

Download
memory/1708-61-0x0000000000220000-0x0000000000227000-memory.dmp

Filesize
28KB

Download
memory/1708-55-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1708-56-0x0000000010001000-0x0000000010013000-memory.dmp

Filesize
72KB

Download
memory/1708-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1708-77-0x00000000000A0000-0x00000000000BF000-memory.dmp

Filesize
124KB

Download
memory/1708-78-0x00000000000A1000-0x00000000000B3000-memory.dmp

Filesize
72KB

Download
memory/1708-84-0x00000000000C0000-0x00000000000C7000-memory.dmp

Filesize
28KB

Download
memory/1708-85-0x00000000000C0000-0x00000000000C7000-memory.dmp

Filesize
28KB

Download