Analysis
-
max time kernel
147s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 06:16
Static task
static1
Behavioral task
behavioral1
Sample
f239667a6ade9c1c22c6605a99aa8d65e6d2ca52e8e933a06f0f07e386cd5367.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f239667a6ade9c1c22c6605a99aa8d65e6d2ca52e8e933a06f0f07e386cd5367.dll
Resource
win10v2004-20220901-en
General
-
Target
f239667a6ade9c1c22c6605a99aa8d65e6d2ca52e8e933a06f0f07e386cd5367.dll
-
Size
468KB
-
MD5
d627a370076f6ca6c28f15c25afebb2d
-
SHA1
9178659637829cd0c018b8ae79f237280ab2f5a4
-
SHA256
f239667a6ade9c1c22c6605a99aa8d65e6d2ca52e8e933a06f0f07e386cd5367
-
SHA512
2e97376fb126bc5177abe6ef2601dba7fe6607d1f24ff1538719d4d20eeec4fa3a496fdbe72772f368da2c23507dede0c6bc261660621a1bfd2ec9102b38188a
-
SSDEEP
12288:fPWOuhRz5Ic31uLJQzXQZJTTzDYR838/hrvkDplKKwpa1:fuzScluloX6crvoU
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
341d.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts 341d.exe -
Executes dropped EXE 4 IoCs
Processes:
341d.exe341d.exe341d.exemtv.exepid process 1700 341d.exe 588 341d.exe 912 341d.exe 988 mtv.exe -
Loads dropped DLL 36 IoCs
Processes:
regsvr32.exerundll32.exe341d.exerundll32.exerundll32.exepid process 1348 regsvr32.exe 2028 rundll32.exe 2028 rundll32.exe 2028 rundll32.exe 2028 rundll32.exe 912 341d.exe 2028 rundll32.exe 2028 rundll32.exe 560 rundll32.exe 560 rundll32.exe 560 rundll32.exe 560 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 1132 rundll32.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe 912 341d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\plc = "c:\\windows\\system32\\rundll32.exe C:\\Windows\\system32/341e.dll,Always" rundll32.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCAA0766-15FC-4aec-A010-F4605D272581} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCAA0766-15FC-4aec-A010-F4605D272581}\ regsvr32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exe341d.exerundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe File opened for modification \??\PhysicalDrive0 341d.exe File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 20 IoCs
Processes:
rundll32.exemtv.exerundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\a1l8.dlltmp rundll32.exe File opened for modification C:\Windows\SysWOW64\b4cb.dlltmp rundll32.exe File opened for modification C:\Windows\SysWOW64\144d.exe rundll32.exe File opened for modification C:\Windows\SysWOW64\4f3r.dlltmp rundll32.exe File opened for modification C:\Windows\SysWOW64\341e.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\b34o.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\3bef.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\a1l8.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\1ba4.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\b34o.dlltmp rundll32.exe File opened for modification C:\Windows\SysWOW64\s.exe mtv.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\14rb.exe rundll32.exe File opened for modification C:\Windows\SysWOW64\b4cb.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\b3fs.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\4f3r.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\341d.exe rundll32.exe File opened for modification C:\Windows\SysWOW64\34ua.exe rundll32.exe File created C:\Windows\SysWOW64\`ó$-58-86-3956 rundll32.exe File created C:\Windows\SysWOW64\3c57 rundll32.exe -
Drops file in Windows directory 13 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\a34b.flv rundll32.exe File opened for modification C:\Windows\8f6.exe rundll32.exe File opened for modification C:\Windows\a8fd.exe rundll32.exe File opened for modification C:\Windows\ba8u.bmp rundll32.exe File created C:\Windows\Tasks\ms.job rundll32.exe File opened for modification C:\Windows\bf14.bmp rundll32.exe File opened for modification C:\Windows\14ba.exe rundll32.exe File opened for modification C:\Windows\6f1u.bmp rundll32.exe File opened for modification C:\Windows\4bad.flv rundll32.exe File opened for modification C:\Windows\ba8d.exe rundll32.exe File opened for modification C:\Windows\ba8d.flv rundll32.exe File opened for modification C:\Windows\f6f.bmp rundll32.exe File opened for modification C:\Windows\a8f.flv rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 47 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\ = "CFffPlayer Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\AppID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\CLSID\ = "{FCAA0766-15FC-4aec-A010-F4605D272581}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\ = "CFffPlayer Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\InprocServer32\ = "C:\\Windows\\SysWow64\\b34o.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\b34o.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CLSID\ = "{FCAA0766-15FC-4aec-A010-F4605D272581}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CurVer\ = "BHO.FffPlayer.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\ = "BHO 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\TypeLib\ = "{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ = "IFffPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\ProgID\ = "BHO.FffPlayer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\InprocServer32\ThreadingModel = "apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ = "IFffPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\ = "{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\ = "{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\ = "CFffPlayer Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\VersionIndependentProgID\ = "BHO.FffPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\HELPDIR regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
341d.exepid process 912 341d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
mtv.exepid process 988 mtv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exe341d.exedescription pid process target process PID 980 wrote to memory of 2028 980 rundll32.exe rundll32.exe PID 980 wrote to memory of 2028 980 rundll32.exe rundll32.exe PID 980 wrote to memory of 2028 980 rundll32.exe rundll32.exe PID 980 wrote to memory of 2028 980 rundll32.exe rundll32.exe PID 980 wrote to memory of 2028 980 rundll32.exe rundll32.exe PID 980 wrote to memory of 2028 980 rundll32.exe rundll32.exe PID 980 wrote to memory of 2028 980 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2008 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 2008 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 2008 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 2008 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 2008 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 2008 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 2008 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1484 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1484 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1484 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1484 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1484 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1484 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1484 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1724 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1724 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1724 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1724 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1724 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1724 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1724 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 864 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 864 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 864 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 864 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 864 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 864 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 864 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1348 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1348 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1348 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1348 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1348 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1348 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1348 2028 rundll32.exe regsvr32.exe PID 2028 wrote to memory of 1700 2028 rundll32.exe 341d.exe PID 2028 wrote to memory of 1700 2028 rundll32.exe 341d.exe PID 2028 wrote to memory of 1700 2028 rundll32.exe 341d.exe PID 2028 wrote to memory of 1700 2028 rundll32.exe 341d.exe PID 2028 wrote to memory of 588 2028 rundll32.exe 341d.exe PID 2028 wrote to memory of 588 2028 rundll32.exe 341d.exe PID 2028 wrote to memory of 588 2028 rundll32.exe 341d.exe PID 2028 wrote to memory of 588 2028 rundll32.exe 341d.exe PID 2028 wrote to memory of 988 2028 rundll32.exe mtv.exe PID 2028 wrote to memory of 988 2028 rundll32.exe mtv.exe PID 2028 wrote to memory of 988 2028 rundll32.exe mtv.exe PID 2028 wrote to memory of 988 2028 rundll32.exe mtv.exe PID 912 wrote to memory of 560 912 341d.exe rundll32.exe PID 912 wrote to memory of 560 912 341d.exe rundll32.exe PID 912 wrote to memory of 560 912 341d.exe rundll32.exe PID 912 wrote to memory of 560 912 341d.exe rundll32.exe PID 912 wrote to memory of 560 912 341d.exe rundll32.exe PID 912 wrote to memory of 560 912 341d.exe rundll32.exe PID 912 wrote to memory of 560 912 341d.exe rundll32.exe PID 2028 wrote to memory of 1132 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 1132 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 1132 2028 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f239667a6ade9c1c22c6605a99aa8d65e6d2ca52e8e933a06f0f07e386cd5367.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f239667a6ade9c1c22c6605a99aa8d65e6d2ca52e8e933a06f0f07e386cd5367.dll,#12⤵
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/a1l8.dll"3⤵
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/b4cb.dll"3⤵
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/4f3r.dll"3⤵
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/b34o.dll"3⤵
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Windows\system32/b34o.dll"3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
-
C:\Windows\SysWOW64\341d.exeC:\Windows\system32/341d.exe -i3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\341d.exeC:\Windows\system32/341d.exe -s3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exeC:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32/341e.dll, Always3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\341d.exeC:\Windows\SysWOW64\341d.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32 C:\Windows\system32/341e.dll,Always2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exeFilesize
40KB
MD51235104c820633495885aff907a7dc1e
SHA1da8442f48a00281591bf546cf4efa354525b1910
SHA256d7e2deedf4e71b41470e485a1c2363d5e42568312988fa3fb05317f7b1277d4c
SHA512447b9b860bf6e9ba0ad8ebc9c3cc4b03884171edacaf0704a276385f4429ad95d0c25d60e602f3bb2c2abcf7f58b9d03b7579652767e08fff58ea68cb1f1e726
-
C:\Windows\SysWOW64\341d.exeFilesize
188KB
MD5f5610a2d58dd84232f9f7b91f63afc50
SHA10c3a6856f32f4ad28ce05439845c344b69ba028e
SHA256c49df789d6cfabacff560e7c43181e9180b1845966adcbd80f647ce69f8dbbde
SHA5127cc84d87bfe3f3174b368fe008bb97c39ffa48322ea09b06161ccff0979683a9643685eb2d23efd6f4943c3e562c81520a8a73b8c2e342d7f292702a79165c3d
-
C:\Windows\SysWOW64\341d.exeFilesize
188KB
MD5f5610a2d58dd84232f9f7b91f63afc50
SHA10c3a6856f32f4ad28ce05439845c344b69ba028e
SHA256c49df789d6cfabacff560e7c43181e9180b1845966adcbd80f647ce69f8dbbde
SHA5127cc84d87bfe3f3174b368fe008bb97c39ffa48322ea09b06161ccff0979683a9643685eb2d23efd6f4943c3e562c81520a8a73b8c2e342d7f292702a79165c3d
-
C:\Windows\SysWOW64\341d.exeFilesize
188KB
MD5f5610a2d58dd84232f9f7b91f63afc50
SHA10c3a6856f32f4ad28ce05439845c344b69ba028e
SHA256c49df789d6cfabacff560e7c43181e9180b1845966adcbd80f647ce69f8dbbde
SHA5127cc84d87bfe3f3174b368fe008bb97c39ffa48322ea09b06161ccff0979683a9643685eb2d23efd6f4943c3e562c81520a8a73b8c2e342d7f292702a79165c3d
-
C:\Windows\SysWOW64\341e.dllFilesize
376KB
MD5093255ff11c9d155110d74fd9c3e0e1c
SHA1ef924e73d6fa257d8fc5d5c62d7cbd6e67a13f34
SHA256baa9c408c98bea99b60b37669bb900e0703a79a62b8d492ffe8960e96e15d7cc
SHA512166bbdca91cbeef5d8e1a197dc078d7424addd2eeff41eb99068e399c6a112be0c4dbb3adf36b0e3ddb4f4b55149cb1e87095c77641c18ae68e412512402c596
-
C:\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exeFilesize
40KB
MD51235104c820633495885aff907a7dc1e
SHA1da8442f48a00281591bf546cf4efa354525b1910
SHA256d7e2deedf4e71b41470e485a1c2363d5e42568312988fa3fb05317f7b1277d4c
SHA512447b9b860bf6e9ba0ad8ebc9c3cc4b03884171edacaf0704a276385f4429ad95d0c25d60e602f3bb2c2abcf7f58b9d03b7579652767e08fff58ea68cb1f1e726
-
\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exeFilesize
40KB
MD51235104c820633495885aff907a7dc1e
SHA1da8442f48a00281591bf546cf4efa354525b1910
SHA256d7e2deedf4e71b41470e485a1c2363d5e42568312988fa3fb05317f7b1277d4c
SHA512447b9b860bf6e9ba0ad8ebc9c3cc4b03884171edacaf0704a276385f4429ad95d0c25d60e602f3bb2c2abcf7f58b9d03b7579652767e08fff58ea68cb1f1e726
-
\Windows\SysWOW64\341d.exeFilesize
188KB
MD5f5610a2d58dd84232f9f7b91f63afc50
SHA10c3a6856f32f4ad28ce05439845c344b69ba028e
SHA256c49df789d6cfabacff560e7c43181e9180b1845966adcbd80f647ce69f8dbbde
SHA5127cc84d87bfe3f3174b368fe008bb97c39ffa48322ea09b06161ccff0979683a9643685eb2d23efd6f4943c3e562c81520a8a73b8c2e342d7f292702a79165c3d
-
\Windows\SysWOW64\341d.exeFilesize
188KB
MD5f5610a2d58dd84232f9f7b91f63afc50
SHA10c3a6856f32f4ad28ce05439845c344b69ba028e
SHA256c49df789d6cfabacff560e7c43181e9180b1845966adcbd80f647ce69f8dbbde
SHA5127cc84d87bfe3f3174b368fe008bb97c39ffa48322ea09b06161ccff0979683a9643685eb2d23efd6f4943c3e562c81520a8a73b8c2e342d7f292702a79165c3d
-
\Windows\SysWOW64\341d.exeFilesize
188KB
MD5f5610a2d58dd84232f9f7b91f63afc50
SHA10c3a6856f32f4ad28ce05439845c344b69ba028e
SHA256c49df789d6cfabacff560e7c43181e9180b1845966adcbd80f647ce69f8dbbde
SHA5127cc84d87bfe3f3174b368fe008bb97c39ffa48322ea09b06161ccff0979683a9643685eb2d23efd6f4943c3e562c81520a8a73b8c2e342d7f292702a79165c3d
-
\Windows\SysWOW64\341d.exeFilesize
188KB
MD5f5610a2d58dd84232f9f7b91f63afc50
SHA10c3a6856f32f4ad28ce05439845c344b69ba028e
SHA256c49df789d6cfabacff560e7c43181e9180b1845966adcbd80f647ce69f8dbbde
SHA5127cc84d87bfe3f3174b368fe008bb97c39ffa48322ea09b06161ccff0979683a9643685eb2d23efd6f4943c3e562c81520a8a73b8c2e342d7f292702a79165c3d
-
\Windows\SysWOW64\341e.dllFilesize
376KB
MD5093255ff11c9d155110d74fd9c3e0e1c
SHA1ef924e73d6fa257d8fc5d5c62d7cbd6e67a13f34
SHA256baa9c408c98bea99b60b37669bb900e0703a79a62b8d492ffe8960e96e15d7cc
SHA512166bbdca91cbeef5d8e1a197dc078d7424addd2eeff41eb99068e399c6a112be0c4dbb3adf36b0e3ddb4f4b55149cb1e87095c77641c18ae68e412512402c596
-
\Windows\SysWOW64\341e.dllFilesize
376KB
MD5093255ff11c9d155110d74fd9c3e0e1c
SHA1ef924e73d6fa257d8fc5d5c62d7cbd6e67a13f34
SHA256baa9c408c98bea99b60b37669bb900e0703a79a62b8d492ffe8960e96e15d7cc
SHA512166bbdca91cbeef5d8e1a197dc078d7424addd2eeff41eb99068e399c6a112be0c4dbb3adf36b0e3ddb4f4b55149cb1e87095c77641c18ae68e412512402c596
-
\Windows\SysWOW64\341e.dllFilesize
376KB
MD5093255ff11c9d155110d74fd9c3e0e1c
SHA1ef924e73d6fa257d8fc5d5c62d7cbd6e67a13f34
SHA256baa9c408c98bea99b60b37669bb900e0703a79a62b8d492ffe8960e96e15d7cc
SHA512166bbdca91cbeef5d8e1a197dc078d7424addd2eeff41eb99068e399c6a112be0c4dbb3adf36b0e3ddb4f4b55149cb1e87095c77641c18ae68e412512402c596
-
\Windows\SysWOW64\341e.dllFilesize
376KB
MD5093255ff11c9d155110d74fd9c3e0e1c
SHA1ef924e73d6fa257d8fc5d5c62d7cbd6e67a13f34
SHA256baa9c408c98bea99b60b37669bb900e0703a79a62b8d492ffe8960e96e15d7cc
SHA512166bbdca91cbeef5d8e1a197dc078d7424addd2eeff41eb99068e399c6a112be0c4dbb3adf36b0e3ddb4f4b55149cb1e87095c77641c18ae68e412512402c596
-
\Windows\SysWOW64\341e.dllFilesize
376KB
MD5093255ff11c9d155110d74fd9c3e0e1c
SHA1ef924e73d6fa257d8fc5d5c62d7cbd6e67a13f34
SHA256baa9c408c98bea99b60b37669bb900e0703a79a62b8d492ffe8960e96e15d7cc
SHA512166bbdca91cbeef5d8e1a197dc078d7424addd2eeff41eb99068e399c6a112be0c4dbb3adf36b0e3ddb4f4b55149cb1e87095c77641c18ae68e412512402c596
-
\Windows\SysWOW64\341e.dllFilesize
376KB
MD5093255ff11c9d155110d74fd9c3e0e1c
SHA1ef924e73d6fa257d8fc5d5c62d7cbd6e67a13f34
SHA256baa9c408c98bea99b60b37669bb900e0703a79a62b8d492ffe8960e96e15d7cc
SHA512166bbdca91cbeef5d8e1a197dc078d7424addd2eeff41eb99068e399c6a112be0c4dbb3adf36b0e3ddb4f4b55149cb1e87095c77641c18ae68e412512402c596
-
\Windows\SysWOW64\341e.dllFilesize
376KB
MD5093255ff11c9d155110d74fd9c3e0e1c
SHA1ef924e73d6fa257d8fc5d5c62d7cbd6e67a13f34
SHA256baa9c408c98bea99b60b37669bb900e0703a79a62b8d492ffe8960e96e15d7cc
SHA512166bbdca91cbeef5d8e1a197dc078d7424addd2eeff41eb99068e399c6a112be0c4dbb3adf36b0e3ddb4f4b55149cb1e87095c77641c18ae68e412512402c596
-
\Windows\SysWOW64\341e.dllFilesize
376KB
MD5093255ff11c9d155110d74fd9c3e0e1c
SHA1ef924e73d6fa257d8fc5d5c62d7cbd6e67a13f34
SHA256baa9c408c98bea99b60b37669bb900e0703a79a62b8d492ffe8960e96e15d7cc
SHA512166bbdca91cbeef5d8e1a197dc078d7424addd2eeff41eb99068e399c6a112be0c4dbb3adf36b0e3ddb4f4b55149cb1e87095c77641c18ae68e412512402c596
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
\Windows\SysWOW64\b34o.dllFilesize
140KB
MD579adcac7d78ad1fc1f0f6cec3ff33199
SHA19650c79ade76c6047acbb8a75311095583d9f9e1
SHA256e7822d54f80879f9cfb1127e14667887fc71df97ff056f800243dbc578eb8d68
SHA512ffd9c6a65d1faf24a81f6a14574b992ace688c274c0fbdfba969f23ecf3e71f2c2c2da9ab5dd78f237bb8dbef6682725e26a6f537eb17355e46f6313f68c04b0
-
memory/560-88-0x0000000000000000-mapping.dmp
-
memory/588-74-0x0000000000000000-mapping.dmp
-
memory/864-62-0x0000000000000000-mapping.dmp
-
memory/988-87-0x0000000000000000-mapping.dmp
-
memory/1132-98-0x0000000000000000-mapping.dmp
-
memory/1348-64-0x0000000000000000-mapping.dmp
-
memory/1484-58-0x0000000000000000-mapping.dmp
-
memory/1700-70-0x0000000000000000-mapping.dmp
-
memory/1724-60-0x0000000000000000-mapping.dmp
-
memory/2008-56-0x0000000000000000-mapping.dmp
-
memory/2028-54-0x0000000000000000-mapping.dmp
-
memory/2028-55-0x0000000075811000-0x0000000075813000-memory.dmpFilesize
8KB