Analysis

  • max time kernel
    162s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 01:25

General

  • Target

    8995ffa8579bb1f063e8d91cd18554bef4091ccde1f2e97c8a6b0308ee4088ef.dll

  • Size

    16KB

  • MD5

    8e42e25275ea66093d24ea97b6cdab80

  • SHA1

    8f3ba8413f3433b9cdc65349401b3bd165a33c75

  • SHA256

    8995ffa8579bb1f063e8d91cd18554bef4091ccde1f2e97c8a6b0308ee4088ef

  • SHA512

    224556ff49a37ca942e65f1897851dc16129aae6eccc248b8ba5b8e176be7ad893b38693b0c9f6965f055df0cf1212ed758532a1aac99c713534861eeb195814

  • SSDEEP

    384:9bx9prGsDy7N3EGbp/D4yVDgYSEmLsnpBg:j9p5Dy7N3TbD/SIBg

Score
8/10

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1296
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\8995ffa8579bb1f063e8d91cd18554bef4091ccde1f2e97c8a6b0308ee4088ef.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\8995ffa8579bb1f063e8d91cd18554bef4091ccde1f2e97c8a6b0308ee4088ef.dll,#1
        3⤵
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:532

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/532-55-0x0000000075531000-0x0000000075533000-memory.dmp

    Filesize

    8KB