Analysis
-
max time kernel
197s -
max time network
234s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 16:59
Behavioral task
behavioral1
Sample
52782f6008ba2fa81580365a7f46889db847849fd121a61789d87320c8d091aa.dll
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
General
-
Target
52782f6008ba2fa81580365a7f46889db847849fd121a61789d87320c8d091aa.dll
-
Size
21KB
-
MD5
757a08e2b45fd1b6f7151b4857d03210
-
SHA1
91e5e6e59a31bd340af1a4c1cada85e5448b52bb
-
SHA256
52782f6008ba2fa81580365a7f46889db847849fd121a61789d87320c8d091aa
-
SHA512
09884572f202c7d84e12be472e53e2f29dd76d86cc3aeb102797310ca5a7eb29f681e1825c6375d0305f775e546e213cc135b378c640f8a5b38e0afb2629688a
-
SSDEEP
384:iLWCpCJ6xhNN8S0gPW2KUCphaMTaR3ItDCuV9UAvdOh+/3o:4zZtN8SVKUCpJTaItO4U6di+/
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
resource yara_rule behavioral2/memory/3940-133-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3940-140-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4196 sc.exe 912 sc.exe 3840 sc.exe 4912 sc.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe 3940 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3940 rundll32.exe Token: SeAuditPrivilege 3128 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4856 wrote to memory of 3940 4856 rundll32.exe 83 PID 4856 wrote to memory of 3940 4856 rundll32.exe 83 PID 4856 wrote to memory of 3940 4856 rundll32.exe 83 PID 3940 wrote to memory of 1472 3940 rundll32.exe 84 PID 3940 wrote to memory of 1472 3940 rundll32.exe 84 PID 3940 wrote to memory of 1472 3940 rundll32.exe 84 PID 3940 wrote to memory of 4196 3940 rundll32.exe 86 PID 3940 wrote to memory of 4196 3940 rundll32.exe 86 PID 3940 wrote to memory of 4196 3940 rundll32.exe 86 PID 3940 wrote to memory of 912 3940 rundll32.exe 88 PID 3940 wrote to memory of 912 3940 rundll32.exe 88 PID 3940 wrote to memory of 912 3940 rundll32.exe 88 PID 3940 wrote to memory of 3840 3940 rundll32.exe 90 PID 3940 wrote to memory of 3840 3940 rundll32.exe 90 PID 3940 wrote to memory of 3840 3940 rundll32.exe 90 PID 3940 wrote to memory of 4912 3940 rundll32.exe 93 PID 3940 wrote to memory of 4912 3940 rundll32.exe 93 PID 3940 wrote to memory of 4912 3940 rundll32.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52782f6008ba2fa81580365a7f46889db847849fd121a61789d87320c8d091aa.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52782f6008ba2fa81580365a7f46889db847849fd121a61789d87320c8d091aa.dll,#12⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe import "C:\Users\Admin\fstg.avi"3⤵PID:1472
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe config PolicyAgent start=auto3⤵
- Launches sc.exe
PID:4196
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe stop PolicyAgent3⤵
- Launches sc.exe
PID:912
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe start PolicyAgent3⤵
- Launches sc.exe
PID:3840
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe stop PolicyAgent3⤵
- Launches sc.exe
PID:4912
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5bc8025bc98da7f4ed891c9f9991d3ff1
SHA170a69a7fcebe9b43f00a1fa713e3a0621bf3ac6d
SHA25659b9dc39d69f8b0aa350f550e42e632b396237865776d0ce75477f8fe3f9016f
SHA5127f772261e003d2df9162ae4aeaab2bda674ee2721b3300cc8b2a2f4904af6bc9c565c7f2c3e67a7394eb1a387860a2544fc5bdc3e6de384b664f8d232ad6acf5