Analysis
- max time kernel
151s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
29/11/2022, 15:04
General
- Target file.exe
- Size 3.6MB
- Sample221129-sflvdaaf87
- SHA256 0909322dede6d2639bc5aba3de6bbe4a6b9552df002547378c35629b1ceefedf
Malware Config
Signatures
- Blocklisted process makes network request 3 IoCs
- Loads dropped DLL 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Serpodtudpwhhta.dll,start2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 137233⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 3762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5056 -ip 50561⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Stamp..dll
Stamp..dll
C2RManifest.shared.Office.x-none.msi.16.x-none.xml
F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy.xml
Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe.xml
Ohuyieysirps.tmp
resource.xml
Serpodtudpwhhta.dll
Serpodtudpwhhta.dll
stamp..dll
memory/1464-169-0x0000000001F40000-0x0000000002A8D000-memory.dmp
memory/1464-163-0x0000000001400000-0x0000000001857000-memory.dmp
memory/1464-162-0x0000000001400000-0x0000000001857000-memory.dmp
memory/1464-170-0x0000000001F40000-0x0000000002A8D000-memory.dmp
memory/1464-171-0x0000000001F40000-0x0000000002A8D000-memory.dmp
memory/4172-153-0x0000024147170000-0x00000241472B0000-memory.dmp
memory/4172-157-0x0000024145720000-0x00000241459C8000-memory.dmp
memory/4172-156-0x00000000003E0000-0x0000000000676000-memory.dmp
memory/4172-154-0x0000024147170000-0x00000241472B0000-memory.dmp
memory/5008-146-0x0000000004730000-0x0000000004870000-memory.dmp
memory/5008-145-0x0000000004730000-0x0000000004870000-memory.dmp
memory/5008-151-0x0000000004730000-0x0000000004870000-memory.dmp
memory/5008-155-0x00000000047A9000-0x00000000047AB000-memory.dmp
memory/5008-150-0x0000000004730000-0x0000000004870000-memory.dmp
memory/5008-149-0x00000000047A9000-0x00000000047AB000-memory.dmp
memory/5008-158-0x0000000003B20000-0x000000000466D000-memory.dmp
memory/5008-147-0x0000000004730000-0x0000000004870000-memory.dmp
memory/5008-148-0x0000000004730000-0x0000000004870000-memory.dmp
memory/5008-144-0x0000000003B20000-0x000000000466D000-memory.dmp
memory/5008-143-0x0000000003B20000-0x000000000466D000-memory.dmp
memory/5008-142-0x0000000003B20000-0x000000000466D000-memory.dmp
memory/5008-141-0x0000000000400000-0x0000000000857000-memory.dmp
memory/5008-138-0x0000000000400000-0x0000000000857000-memory.dmp
memory/5056-139-0x0000000002BE0000-0x00000000030C5000-memory.dmp
memory/5056-140-0x0000000000400000-0x00000000008F2000-memory.dmp
memory/5056-132-0x0000000002858000-0x0000000002BDD000-memory.dmp
memory/5056-134-0x0000000000400000-0x00000000008F2000-memory.dmp
memory/5056-133-0x0000000002BE0000-0x00000000030C5000-memory.dmp