ce3e910209c1fedd223fc7ca4984018c114304c8c288f4a4be9baf5c3f67dd67

Analysis

max time kernel
97s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce3e910209c1fedd223fc7ca4984018c114304c8c288f4a4be9baf5c3f67dd67.dll
Size

64KB
MD5

c26eb81672b0dd4f211be226e74e0337
SHA1

82f216469ca100811000e44dbb0ac141c0c07b67
SHA256

ce3e910209c1fedd223fc7ca4984018c114304c8c288f4a4be9baf5c3f67dd67
SHA512

79b6e5b394cd1d1c71d764e6c47685e536cbfe6fe86cf139956f9e038f8a2d6ad10b1afcaf9580874515d204e1fdd6cbe94636f13bb87e5f4451f7e1c11033e5
SSDEEP

768:w2biHHAYsX1pp/CcSBgEiAhB+H0mnTEDF5TvysTxygqTrSPprbyvqCqgEwtELt+F:wamHFs79DnIY3Ns9Nrb5CCIl

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\KAV\CDriver.sys	rundll32.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1872	sc.exe
916	sc.exe
1644	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1480	rundll32.exe
1480	rundll32.exe
1480	rundll32.exe
1480	rundll32.exe
1480	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1480	1296	rundll32.exe	28
PID 1296 wrote to memory of 1480	1296	rundll32.exe	28
PID 1296 wrote to memory of 1480	1296	rundll32.exe	28
PID 1296 wrote to memory of 1480	1296	rundll32.exe	28
PID 1296 wrote to memory of 1480	1296	rundll32.exe	28
PID 1296 wrote to memory of 1480	1296	rundll32.exe	28
PID 1296 wrote to memory of 1480	1296	rundll32.exe	28
PID 1480 wrote to memory of 1476	1480	rundll32.exe	29
PID 1480 wrote to memory of 1476	1480	rundll32.exe	29
PID 1480 wrote to memory of 1476	1480	rundll32.exe	29
PID 1480 wrote to memory of 1476	1480	rundll32.exe	29
PID 1480 wrote to memory of 752	1480	rundll32.exe	33
PID 1480 wrote to memory of 752	1480	rundll32.exe	33
PID 1480 wrote to memory of 752	1480	rundll32.exe	33
PID 1480 wrote to memory of 752	1480	rundll32.exe	33
PID 1480 wrote to memory of 1644	1480	rundll32.exe	30
PID 1480 wrote to memory of 1644	1480	rundll32.exe	30
PID 1480 wrote to memory of 1644	1480	rundll32.exe	30
PID 1480 wrote to memory of 1644	1480	rundll32.exe	30
PID 1480 wrote to memory of 1872	1480	rundll32.exe	34
PID 1480 wrote to memory of 1872	1480	rundll32.exe	34
PID 1480 wrote to memory of 1872	1480	rundll32.exe	34
PID 1480 wrote to memory of 1872	1480	rundll32.exe	34
PID 1476 wrote to memory of 1956	1476	net.exe	37
PID 1476 wrote to memory of 1956	1476	net.exe	37
PID 1476 wrote to memory of 1956	1476	net.exe	37
PID 1476 wrote to memory of 1956	1476	net.exe	37
PID 752 wrote to memory of 1352	752	net.exe	38
PID 752 wrote to memory of 1352	752	net.exe	38
PID 752 wrote to memory of 1352	752	net.exe	38
PID 752 wrote to memory of 1352	752	net.exe	38
PID 1480 wrote to memory of 916	1480	rundll32.exe	39
PID 1480 wrote to memory of 916	1480	rundll32.exe	39
PID 1480 wrote to memory of 916	1480	rundll32.exe	39
PID 1480 wrote to memory of 916	1480	rundll32.exe	39

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce3e910209c1fedd223fc7ca4984018c114304c8c288f4a4be9baf5c3f67dd67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce3e910209c1fedd223fc7ca4984018c114304c8c288f4a4be9baf5c3f67dd67.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:1956
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:1644
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:1352
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1872
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop PolicyAgent
    3⤵
    - Launches sc.exe
    PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-55-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download