fb794842a0cb0963a8b52a327d884d1fc4887e046d03e9924d2eab372d0d64b8

Analysis

max time kernel
174s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb794842a0cb0963a8b52a327d884d1fc4887e046d03e9924d2eab372d0d64b8.exe
Size

131KB
MD5

6d73d1dec61de5285072be9f76c66ba6
SHA1

8218002151d0623f5a4adceafc7b86e0cd338a1a
SHA256

fb794842a0cb0963a8b52a327d884d1fc4887e046d03e9924d2eab372d0d64b8
SHA512

0a18f392dd817fa49bdbd0a175ca64bb9477d12ed4d10f7f3123808900906f1d680b058df1e73bb47fd78d996040db5bd658bb1ec9b3b7e1da3d8d0b66336c0a
SSDEEP

3072:Ntf18giGtpKIlgTDEfuIEzRdrZ9r8viQ0FR/cawe9o7pP:bqIlgHEfeZmQApP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1152	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C575E8A8-16E2-4C95-AE36-0BA9C90710B0 = "C:\\Users\\Admin\\AppData\\Local\\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\\rundll32.exe"	fb794842a0cb0963a8b52a327d884d1fc4887e046d03e9924d2eab372d0d64b8.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\D:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\F:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1152	2240	fb794842a0cb0963a8b52a327d884d1fc4887e046d03e9924d2eab372d0d64b8.exe	80
PID 2240 wrote to memory of 1152	2240	fb794842a0cb0963a8b52a327d884d1fc4887e046d03e9924d2eab372d0d64b8.exe	80
PID 2240 wrote to memory of 1152	2240	fb794842a0cb0963a8b52a327d884d1fc4887e046d03e9924d2eab372d0d64b8.exe	80

C:\Users\Admin\AppData\Local\Temp\fb794842a0cb0963a8b52a327d884d1fc4887e046d03e9924d2eab372d0d64b8.exe
"C:\Users\Admin\AppData\Local\Temp\fb794842a0cb0963a8b52a327d884d1fc4887e046d03e9924d2eab372d0d64b8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe
  C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe

Filesize
131KB

MD5
6d73d1dec61de5285072be9f76c66ba6

SHA1
8218002151d0623f5a4adceafc7b86e0cd338a1a

SHA256
fb794842a0cb0963a8b52a327d884d1fc4887e046d03e9924d2eab372d0d64b8

SHA512
0a18f392dd817fa49bdbd0a175ca64bb9477d12ed4d10f7f3123808900906f1d680b058df1e73bb47fd78d996040db5bd658bb1ec9b3b7e1da3d8d0b66336c0a

Download Submit
C:\Users\Admin\AppData\Local\C575E8A8-16E2-4C95-AE36-0BA9C90710B0\rundll32.exe

Filesize
131KB

MD5
6d73d1dec61de5285072be9f76c66ba6

SHA1
8218002151d0623f5a4adceafc7b86e0cd338a1a

SHA256
fb794842a0cb0963a8b52a327d884d1fc4887e046d03e9924d2eab372d0d64b8

SHA512
0a18f392dd817fa49bdbd0a175ca64bb9477d12ed4d10f7f3123808900906f1d680b058df1e73bb47fd78d996040db5bd658bb1ec9b3b7e1da3d8d0b66336c0a

Download Submit
memory/1152-135-0x0000000000000000-mapping.dmp

Download
memory/1152-139-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/1152-140-0x00000000024F0000-0x0000000002615000-memory.dmp

Filesize
1.1MB

Download
memory/1152-141-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/1152-142-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/2240-132-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/2240-133-0x0000000002210000-0x0000000002335000-memory.dmp

Filesize
1.1MB

Download
memory/2240-134-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/2240-138-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download