ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c

Analysis

max time kernel
40s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe
Size

45KB
MD5

64a3c7feb64ee0f44cb957e87e8ad59b
SHA1

62a2cd9cd2ad4edf4624580adf94ae2c74e8e0b3
SHA256

ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c
SHA512

fb1fc902d302f96df0d123dc45e9c848da932b4f1625d6a0972b0e3bd5b1e313e74c13a0039d2474cd5257cf1de599e3bcf960febd3d65f7585fa82e7707ca39
SSDEEP

768:Nmn2vHRuJKlum5bPTYx+MhXD/MPmQOOueHtih3fAm+VZGP4WU9ge+0cqwXv:E2vxxP5bbo+MBbM1O0HtihYdVZhWU9gd

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/272-62-0x0000000000400000-0x000000000061E000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1664	rundll32.exe

Loads dropped DLL 8 IoCs

pid	Process
1980	rundll32.exe
1980	rundll32.exe
1980	rundll32.exe
1980	rundll32.exe
1664	rundll32.exe
1728	rundll32.exe
1728	rundll32.exe
1980	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\whhfd008.ocx	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\006C709Fce.dll	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe
File opened for modification	C:\Program Files\Common Files\006C709Fce.dll	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe
File created	C:\Program Files\Common Files\whh36001.ocx	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe
File opened for modification	C:\Program Files\Common Files\whh36001.ocx	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1980	rundll32.exe
464	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1980	rundll32.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 1728	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	28
PID 272 wrote to memory of 1728	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	28
PID 272 wrote to memory of 1728	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	28
PID 272 wrote to memory of 1728	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	28
PID 272 wrote to memory of 1728	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	28
PID 272 wrote to memory of 1728	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	28
PID 272 wrote to memory of 1728	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	28
PID 272 wrote to memory of 1980	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	29
PID 272 wrote to memory of 1980	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	29
PID 272 wrote to memory of 1980	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	29
PID 272 wrote to memory of 1980	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	29
PID 272 wrote to memory of 1980	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	29
PID 272 wrote to memory of 1980	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	29
PID 272 wrote to memory of 1980	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	29
PID 272 wrote to memory of 1664	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	30
PID 272 wrote to memory of 1664	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	30
PID 272 wrote to memory of 1664	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	30
PID 272 wrote to memory of 1664	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	30
PID 272 wrote to memory of 1664	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	30
PID 272 wrote to memory of 1664	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	30
PID 272 wrote to memory of 1664	272	ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe	30

C:\Users\Admin\AppData\Local\Temp\ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe
"C:\Users\Admin\AppData\Local\Temp\ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\whhfd008.ocx" pfjieaoidjglkajd
  2⤵
  - Loads dropped DLL
  PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\006C709Fce.dll" m3
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\whh36001.ocx" pfjaoidjglkajd C:\Users\Admin\AppData\Local\Temp\ff5de0071c909f1fecbc523b2f1b9ce8a6bb1fe74c53c885c0414d7caf23b35c.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\006C709Fce.dll

Filesize
10KB

MD5
f1f49fb85ab029ad86c02ebecb892b12

SHA1
664a602f8e843218c1158571714cd0adee1da939

SHA256
f8f3abcf8d43377b49d1edce23a667c9efd9cde86e9afee228e8c3b093013f13

SHA512
600810f5a23067afb483b2fb5cd980c817d1b79da7fd7c5183a2d76f3546c514256f5536791abd4ed4b949518c63ab7c55df3e9b9109df2681fd3df10dbd2673

Download Submit
C:\Program Files\Common Files\whh36001.ocx

Filesize
61KB

MD5
8af4340842d04848f1823fae74d96b5b

SHA1
e0cc0f8c98da50e0a0593700677ee7a287be9135

SHA256
4171c36ed6f89bde17c0c90718f27fb972d0910f82ec76217bf45f15b22fca2c

SHA512
ed19bb3846374373cee0043b9c59845510e7b4dcb8edee2b5869043b58b451e21ebe7116f06daff929dd3929b7b76652e7e619b49aadf0a3a1339489eaf24c5f

Download Submit
C:\Windows\SysWOW64\whhfd008.ocx

Filesize
14KB

MD5
731659d09654891912ac223e20cd10ab

SHA1
13cee04adc7b09ef1c0c6b9abc02d0c7bc02a071

SHA256
672639ce00081bdd6b6ee69e1bc816d0b353ed9713b5a21bac6009907daf3d3b

SHA512
e2b63a180ff6a9ef523f21a9afe9f71f612f617fbab5b791f763c8bccab14d8cb1986729fadba4bc5f29fe9813766bcb88168018f8c6571ec72efc69639f1116

Download Submit
\Program Files\Common Files\006C709Fce.dll

Filesize
10KB

MD5
f1f49fb85ab029ad86c02ebecb892b12

SHA1
664a602f8e843218c1158571714cd0adee1da939

SHA256
f8f3abcf8d43377b49d1edce23a667c9efd9cde86e9afee228e8c3b093013f13

SHA512
600810f5a23067afb483b2fb5cd980c817d1b79da7fd7c5183a2d76f3546c514256f5536791abd4ed4b949518c63ab7c55df3e9b9109df2681fd3df10dbd2673

Download Submit
\Program Files\Common Files\006C709Fce.dll

Filesize
10KB

MD5
f1f49fb85ab029ad86c02ebecb892b12

SHA1
664a602f8e843218c1158571714cd0adee1da939

SHA256
f8f3abcf8d43377b49d1edce23a667c9efd9cde86e9afee228e8c3b093013f13

SHA512
600810f5a23067afb483b2fb5cd980c817d1b79da7fd7c5183a2d76f3546c514256f5536791abd4ed4b949518c63ab7c55df3e9b9109df2681fd3df10dbd2673

Download Submit
\Program Files\Common Files\006C709Fce.dll

Filesize
10KB

MD5
f1f49fb85ab029ad86c02ebecb892b12

SHA1
664a602f8e843218c1158571714cd0adee1da939

SHA256
f8f3abcf8d43377b49d1edce23a667c9efd9cde86e9afee228e8c3b093013f13

SHA512
600810f5a23067afb483b2fb5cd980c817d1b79da7fd7c5183a2d76f3546c514256f5536791abd4ed4b949518c63ab7c55df3e9b9109df2681fd3df10dbd2673

Download Submit
\Program Files\Common Files\006C709Fce.dll

Filesize
10KB

MD5
f1f49fb85ab029ad86c02ebecb892b12

SHA1
664a602f8e843218c1158571714cd0adee1da939

SHA256
f8f3abcf8d43377b49d1edce23a667c9efd9cde86e9afee228e8c3b093013f13

SHA512
600810f5a23067afb483b2fb5cd980c817d1b79da7fd7c5183a2d76f3546c514256f5536791abd4ed4b949518c63ab7c55df3e9b9109df2681fd3df10dbd2673

Download Submit
\Program Files\Common Files\whh36001.ocx

Filesize
61KB

MD5
8af4340842d04848f1823fae74d96b5b

SHA1
e0cc0f8c98da50e0a0593700677ee7a287be9135

SHA256
4171c36ed6f89bde17c0c90718f27fb972d0910f82ec76217bf45f15b22fca2c

SHA512
ed19bb3846374373cee0043b9c59845510e7b4dcb8edee2b5869043b58b451e21ebe7116f06daff929dd3929b7b76652e7e619b49aadf0a3a1339489eaf24c5f

Download Submit
\Program Files\Common Files\whh36001.ocx

Filesize
61KB

MD5
8af4340842d04848f1823fae74d96b5b

SHA1
e0cc0f8c98da50e0a0593700677ee7a287be9135

SHA256
4171c36ed6f89bde17c0c90718f27fb972d0910f82ec76217bf45f15b22fca2c

SHA512
ed19bb3846374373cee0043b9c59845510e7b4dcb8edee2b5869043b58b451e21ebe7116f06daff929dd3929b7b76652e7e619b49aadf0a3a1339489eaf24c5f

Download Submit
\Program Files\Common Files\whh36001.ocx

Filesize
61KB

MD5
8af4340842d04848f1823fae74d96b5b

SHA1
e0cc0f8c98da50e0a0593700677ee7a287be9135

SHA256
4171c36ed6f89bde17c0c90718f27fb972d0910f82ec76217bf45f15b22fca2c

SHA512
ed19bb3846374373cee0043b9c59845510e7b4dcb8edee2b5869043b58b451e21ebe7116f06daff929dd3929b7b76652e7e619b49aadf0a3a1339489eaf24c5f

Download Submit
\Windows\SysWOW64\whhfd008.ocx

Filesize
14KB

MD5
731659d09654891912ac223e20cd10ab

SHA1
13cee04adc7b09ef1c0c6b9abc02d0c7bc02a071

SHA256
672639ce00081bdd6b6ee69e1bc816d0b353ed9713b5a21bac6009907daf3d3b

SHA512
e2b63a180ff6a9ef523f21a9afe9f71f612f617fbab5b791f763c8bccab14d8cb1986729fadba4bc5f29fe9813766bcb88168018f8c6571ec72efc69639f1116

Download Submit
memory/272-62-0x0000000000400000-0x000000000061E000-memory.dmp

Filesize
2.1MB

Download
memory/1664-72-0x0000000010000000-0x0000000010215000-memory.dmp

Filesize
2.1MB

Download
memory/1664-79-0x0000000010000000-0x0000000010215000-memory.dmp

Filesize
2.1MB

Download
memory/1728-56-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1728-73-0x0000000010000000-0x0000000010208000-memory.dmp

Filesize
2.0MB

Download
memory/1728-74-0x0000000000970000-0x0000000000B85000-memory.dmp

Filesize
2.1MB

Download
memory/1728-77-0x0000000000970000-0x0000000000B85000-memory.dmp

Filesize
2.1MB

Download
memory/1980-71-0x0000000010000000-0x0000000010206000-memory.dmp

Filesize
2.0MB

Download
memory/1980-76-0x0000000002370000-0x0000000002585000-memory.dmp

Filesize
2.1MB

Download
memory/1980-78-0x0000000010000000-0x0000000010206000-memory.dmp

Filesize
2.0MB

Download
memory/1980-80-0x0000000002370000-0x0000000002585000-memory.dmp

Filesize
2.1MB

Download