ce3e910209c1fedd223fc7ca4984018c114304c8c288f4a4be9baf5c3f67dd67

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce3e910209c1fedd223fc7ca4984018c114304c8c288f4a4be9baf5c3f67dd67.dll
Size

64KB
MD5

c26eb81672b0dd4f211be226e74e0337
SHA1

82f216469ca100811000e44dbb0ac141c0c07b67
SHA256

ce3e910209c1fedd223fc7ca4984018c114304c8c288f4a4be9baf5c3f67dd67
SHA512

79b6e5b394cd1d1c71d764e6c47685e536cbfe6fe86cf139956f9e038f8a2d6ad10b1afcaf9580874515d204e1fdd6cbe94636f13bb87e5f4451f7e1c11033e5
SSDEEP

768:w2biHHAYsX1pp/CcSBgEiAhB+H0mnTEDF5TvysTxygqTrSPprbyvqCqgEwtELt+F:wamHFs79DnIY3Ns9Nrb5CCIl

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	rundll32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\KAV\CDriver.sys	rundll32.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4872	sc.exe
2464	sc.exe
1924	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 4204	764	rundll32.exe	80
PID 764 wrote to memory of 4204	764	rundll32.exe	80
PID 764 wrote to memory of 4204	764	rundll32.exe	80
PID 4204 wrote to memory of 2444	4204	rundll32.exe	83
PID 4204 wrote to memory of 2444	4204	rundll32.exe	83
PID 4204 wrote to memory of 2444	4204	rundll32.exe	83
PID 4204 wrote to memory of 1052	4204	rundll32.exe	84
PID 4204 wrote to memory of 1052	4204	rundll32.exe	84
PID 4204 wrote to memory of 1052	4204	rundll32.exe	84
PID 4204 wrote to memory of 4872	4204	rundll32.exe	86
PID 4204 wrote to memory of 4872	4204	rundll32.exe	86
PID 4204 wrote to memory of 4872	4204	rundll32.exe	86
PID 4204 wrote to memory of 2464	4204	rundll32.exe	90
PID 4204 wrote to memory of 2464	4204	rundll32.exe	90
PID 4204 wrote to memory of 2464	4204	rundll32.exe	90
PID 1052 wrote to memory of 4004	1052	net.exe	92
PID 1052 wrote to memory of 4004	1052	net.exe	92
PID 1052 wrote to memory of 4004	1052	net.exe	92
PID 2444 wrote to memory of 1728	2444	net.exe	91
PID 2444 wrote to memory of 1728	2444	net.exe	91
PID 2444 wrote to memory of 1728	2444	net.exe	91
PID 4204 wrote to memory of 1924	4204	rundll32.exe	93
PID 4204 wrote to memory of 1924	4204	rundll32.exe	93
PID 4204 wrote to memory of 1924	4204	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce3e910209c1fedd223fc7ca4984018c114304c8c288f4a4be9baf5c3f67dd67.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ce3e910209c1fedd223fc7ca4984018c114304c8c288f4a4be9baf5c3f67dd67.dll,#1
  2⤵
  - Checks computer location settings
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:1728
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:4004
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4872
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2464
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop PolicyAgent
    3⤵
    - Launches sc.exe
    PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Windows 7 deprecation

Loading Replay Monitor...