f0d88ad572088220a2c422e2c45c2ddbccaeecc531f02890183cc5a82c2966c8

Analysis

max time kernel
138s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f0d88ad572088220a2c422e2c45c2ddbccaeecc531f02890183cc5a82c2966c8.dll
Size 626KB
Sample221205-gabxfaee8w
SHA256 f0d88ad572088220a2c422e2c45c2ddbccaeecc531f02890183cc5a82c2966c8
MD5 fd7f95ec58baa09235ca8491b9994270
SHA1 7c94cd15d0b92c4c49f5d1328c23a9ef02eaa88b
SHA512 c1184d51fc4dcd01da6c346bdfa1f7ce8d15918aba95bcff2a1ec0c23369cdc0edfe7ec19e92aae84766204b419fd84d6c7cd64905714218f171f5bf6a84052a
SSDEEP 12288:8AGUaFty+yr+Ts4e3kmYn0YaAsPgtdiItM5wzTrr5MRQ2hWHs:8UaFty+yr+Ts4e3kmYn0YaAsAQuM5STO
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\li\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f0d88ad572088220a2c422e2c45c2ddbccaeecc531f02890183cc5a82c2966c8.dll"	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4224	rundll32.exe
4224	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1388	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1388	4972	rundll32.exe	80
PID 4972 wrote to memory of 1388	4972	rundll32.exe	80
PID 4972 wrote to memory of 1388	4972	rundll32.exe	80
PID 3908 wrote to memory of 4224	3908	svchost.exe	82
PID 3908 wrote to memory of 4224	3908	svchost.exe	82
PID 3908 wrote to memory of 4224	3908	svchost.exe	82
PID 1388 wrote to memory of 4440	1388	rundll32.exe	83
PID 1388 wrote to memory of 4440	1388	rundll32.exe	83
PID 1388 wrote to memory of 4440	1388	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0d88ad572088220a2c422e2c45c2ddbccaeecc531f02890183cc5a82c2966c8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f0d88ad572088220a2c422e2c45c2ddbccaeecc531f02890183cc5a82c2966c8.dll,#1
  2⤵
  - Sets DLL path for service in the registry
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\SysWOW64\rundll32.exe" > nul
    3⤵
    PID:4440

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "li"
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe c:\users\admin\appdata\local\temp\f0d88ad572088220a2c422e2c45c2ddbccaeecc531f02890183cc5a82c2966c8.dll, Launch
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3908-135-0x0000000075570000-0x0000000075689000-memory.dmp

Download

memory/4224-136-0x0000000075570000-0x0000000075689000-memory.dmp

Download

memory/4224-137-0x0000000075570000-0x0000000075689000-memory.dmp

Download