3769f8e190bae0b666909b46c3663855ddcab3d06375602b2dab4fabb67977ca

Analysis

max time kernel
57s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3769f8e190bae0b666909b46c3663855ddcab3d06375602b2dab4fabb67977ca.dll
Size

9KB
MD5

a5cee053d0444785404bb80e078d2360
SHA1

1c6aed9e469d46abc784e984de396ab5e28f2b42
SHA256

3769f8e190bae0b666909b46c3663855ddcab3d06375602b2dab4fabb67977ca
SHA512

22bf5defe4e8ecb8b64e9f3bf7a63b9de87a1f111036198f04e252324596a52f7804881195e963b6ad18f143e808f849717da8b00ff315ae4bcfa08f514cf4bd
SSDEEP

192:xpka30kS3OUC+fMjZuJ40/Dej1jzS9un:Db0kSeUCEMebbej1jzbn

Score

10^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 6 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\winnet32.exe\" -run \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\winnet32.exe\" -run \"%1\" %*"	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2004	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\iehlp32.dll	rundll32.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\winnet32.exe\" -run \"%1\" %*"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\winnet32.exe\" -run \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2004	1992	rundll32.exe	27
PID 1992 wrote to memory of 2004	1992	rundll32.exe	27
PID 1992 wrote to memory of 2004	1992	rundll32.exe	27
PID 1992 wrote to memory of 2004	1992	rundll32.exe	27
PID 1992 wrote to memory of 2004	1992	rundll32.exe	27
PID 1992 wrote to memory of 2004	1992	rundll32.exe	27
PID 1992 wrote to memory of 2004	1992	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3769f8e190bae0b666909b46c3663855ddcab3d06375602b2dab4fabb67977ca.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3769f8e190bae0b666909b46c3663855ddcab3d06375602b2dab4fabb67977ca.dll,#1
  2⤵
  - Modifies system executable filetype association
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\iehlp32.dll

Filesize
5KB

MD5
ce69addf8eda0c9d7e679e2e85547b56

SHA1
0559ca91e0ff4d44c1ab7db6e1d3bdc9d21eca64

SHA256
77458158cfc31dfcddfd073fbe6d065497ca51bfd0ba265f13a116eda9844a72

SHA512
4f4c0aaa0efb42a17695a5c388d6ac1a2f192c73b1309c28263c6d335fcc1348b0a7bb02069e22ebd36c33ace4edc17e4909c71a5091cb11dee55e003290916d

Download Submit
memory/2004-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/2004-57-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download