Analysis
-
max time kernel
101s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-01-2023 20:33
Static task
static1
Behavioral task
behavioral1
Sample
025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c.exe
Resource
win10v2004-20220812-en
General
-
Target
025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c.exe
-
Size
1.1MB
-
MD5
a0f0a5939391e1e6435891fcbd3c1f8f
-
SHA1
240a65e3b2fc037e23b631689bdf2b56089b5ff1
-
SHA256
025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c
-
SHA512
e8f8acb13fc39a61e277ec562fb72a3381a6a2b6c912aa17b121010cc04b16b0406f69fafd36029106e6a258155f9a01470af551d63ed8e25dd908960e40030c
-
SSDEEP
24576:Xo3ciGhHIfz+y/iHemincy/2JIGJZwYKl6cE5CjmXNeEh:XEGZIfzuHeminIN9Q61CjsN9
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 15 1276 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1276 rundll32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 1276 set thread context of 3492 1276 rundll32.exe rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4236 1232 WerFault.exe 025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c.exe -
Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
rundll32.exepid process 3492 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c.exerundll32.exedescription pid process target process PID 1232 wrote to memory of 1276 1232 025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c.exe rundll32.exe PID 1232 wrote to memory of 1276 1232 025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c.exe rundll32.exe PID 1232 wrote to memory of 1276 1232 025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c.exe rundll32.exe PID 1276 wrote to memory of 3492 1276 rundll32.exe rundll32.exe PID 1276 wrote to memory of 3492 1276 rundll32.exe rundll32.exe PID 1276 wrote to memory of 3492 1276 rundll32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c.exe"C:\Users\Admin\AppData\Local\Temp\025208b3d2dc191ade69d312f02ae794a9a1b03952e959d7031460aa0100d23c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Dfuqft.tmp",Dsdupihuqo2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 223263⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 5402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1232 -ip 12321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Dfuqft.tmpFilesize
792KB
MD59e3ff54c77c7d43bfdf8cff1d31c3c51
SHA19681f127f0300093ac15d8a3fc16c289f0b9c045
SHA2562c683e8b9889636eb8279bdb6cf9181e939021acb2cbbed109b27aab6f47861d
SHA512d7b6ff58a48ce21250e13ffd1f57f041615e83cfd3fc2627ea0951a32ad8141fbe760765faada136cf3ab31c9165a0ad0f88ef95f35f58735d169046c257fcec
-
C:\Users\Admin\AppData\Local\Temp\Dfuqft.tmpFilesize
792KB
MD59e3ff54c77c7d43bfdf8cff1d31c3c51
SHA19681f127f0300093ac15d8a3fc16c289f0b9c045
SHA2562c683e8b9889636eb8279bdb6cf9181e939021acb2cbbed109b27aab6f47861d
SHA512d7b6ff58a48ce21250e13ffd1f57f041615e83cfd3fc2627ea0951a32ad8141fbe760765faada136cf3ab31c9165a0ad0f88ef95f35f58735d169046c257fcec
-
memory/1232-137-0x0000000000400000-0x0000000000538000-memory.dmpFilesize
1.2MB
-
memory/1232-135-0x000000000219A000-0x0000000002286000-memory.dmpFilesize
944KB
-
memory/1232-136-0x0000000002290000-0x00000000023C2000-memory.dmpFilesize
1.2MB
-
memory/1276-142-0x0000000004A30000-0x0000000004B70000-memory.dmpFilesize
1.2MB
-
memory/1276-145-0x0000000004A30000-0x0000000004B70000-memory.dmpFilesize
1.2MB
-
memory/1276-139-0x0000000006460000-0x0000000006FB7000-memory.dmpFilesize
11.3MB
-
memory/1276-140-0x0000000004A30000-0x0000000004B70000-memory.dmpFilesize
1.2MB
-
memory/1276-141-0x0000000004A30000-0x0000000004B70000-memory.dmpFilesize
1.2MB
-
memory/1276-132-0x0000000000000000-mapping.dmp
-
memory/1276-143-0x0000000004A30000-0x0000000004B70000-memory.dmpFilesize
1.2MB
-
memory/1276-144-0x0000000004A30000-0x0000000004B70000-memory.dmpFilesize
1.2MB
-
memory/1276-152-0x0000000006460000-0x0000000006FB7000-memory.dmpFilesize
11.3MB
-
memory/1276-138-0x0000000006460000-0x0000000006FB7000-memory.dmpFilesize
11.3MB
-
memory/1276-148-0x0000000004AA9000-0x0000000004AAB000-memory.dmpFilesize
8KB
-
memory/3492-149-0x000002571C430000-0x000002571C570000-memory.dmpFilesize
1.2MB
-
memory/3492-147-0x000002571C430000-0x000002571C570000-memory.dmpFilesize
1.2MB
-
memory/3492-150-0x0000000000630000-0x00000000008DE000-memory.dmpFilesize
2.7MB
-
memory/3492-151-0x000002571AB60000-0x000002571AE1F000-memory.dmpFilesize
2.7MB
-
memory/3492-146-0x00007FF75C0A6890-mapping.dmp
-
memory/3492-153-0x000002571AB60000-0x000002571AE1F000-memory.dmpFilesize
2.7MB