Overview

overview

7

Static

static

1

stkhcl32.dll.7z

windows7-x64

3

stkhcl32.dll.7z

windows10-2004-x64

7

Resubmissions

02/03/2023, 14:13

230302-rje1kadc45 7

02/03/2023, 14:12

230302-rhznksdc43 1

02/03/2023, 14:11

230302-rhdfcach31 1

02/03/2023, 14:10

230302-rgvy1ach3y 1

02/03/2023, 14:08

230302-rf21xsch3v 1

Analysis

  • max time kernel
    238s
  • max time network
    200s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2023, 14:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    stkhcl32.dll.7z

  • Size

    8.4MB

  • MD5

    903a766301bd69840c8ab4312dd0272e

  • SHA1

    c2ce6978015676ca4534f27735ccc73f5d0506c9

  • SHA256

    ab70d29d52622c352ad8f36a6fc58a7c0a28d01c9ce25c5e3c97991be9c1cbe4

  • SHA512

    de35dfceabf6a7ddda6cd9c1051edb799fce8b3d7d53fbafebc764c77eb8b575939e784cebf556dc9fb83164cbb1df2a26f25b864b589ce83726b990fcab6b31

  • SSDEEP

    196608:/nSpkvZlBEqXI+4HL2+13dEXYIhnA0PbpBiIajhNA:fqkyRreYCVg/

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 28 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\stkhcl32.dll.7z
    1⤵
    • Modifies registry class
    PID:1904
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" "C:\Users\Admin\AppData\Local\Temp\stkhcl32.dll.7z"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2684
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3288
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Documents\stkhcl32.dll\" -spe -an -ai#7zMap5489:84:7zEvent11218
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3104
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Documents\stkhcl32.dll\" -spe -an -ai#7zMap23798:84:7zEvent27203
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3188
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Windows\system32\rundll32.exe
        rundll32.exe stkhcl32.dll, SessionThread
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3764
      • C:\Windows\system32\rundll32.exe
        rundll32.exe stkhcl32.dll
        2⤵
          PID:3972
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3876
        • C:\Windows\System32\rundll32.exe
          rundll32.exe stkhcl32.dll, SessionThread
          2⤵
            PID:4304

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                Filesize

                28KB

                MD5

                4f0bccd838b03844695a1d58e6ccfbca

                SHA1

                dad3affcab8dcd1e008d1e3041edf415f2bc70a6

                SHA256

                c3df0aedb8886a2568a2628d203665445a64c923808db2c97a7190ddc302a766

                SHA512

                f7ba142df35ecfe007c68fd4c834b186683185d214c00b5954cd9d17f75e73443c4ec75579c8614f679081123968f298919ac4b44c0f364484b5c9d7ad14743c

                Download Submit

              • C:\Users\Admin\Documents\stkhcl32.dll\stkhcl32.dll
                Filesize

                30.5MB

                MD5

                a6fcef9979eef47906812612c8bb1983

                SHA1

                ba50d56eb229813cb0ed8d1e1bbe218b99e6a9de

                SHA256

                c1977043a99665eb97ac02624c647c6b31a25df12e956af21c839d852aaa4e85

                SHA512

                651ae3ae114d4bb0f152edfe0aefa6a3c979cf38da8c47fa2920177ac052c192734cef0ebfd256ae108547d15285b84118ebc9528d8cb885c1d85a1847e30f30

                Download Submit

              • C:\Users\Admin\Documents\stkhcl32.dll\stkhcl32.dll
                Filesize

                30.5MB

                MD5

                a6fcef9979eef47906812612c8bb1983

                SHA1

                ba50d56eb229813cb0ed8d1e1bbe218b99e6a9de

                SHA256

                c1977043a99665eb97ac02624c647c6b31a25df12e956af21c839d852aaa4e85

                SHA512

                651ae3ae114d4bb0f152edfe0aefa6a3c979cf38da8c47fa2920177ac052c192734cef0ebfd256ae108547d15285b84118ebc9528d8cb885c1d85a1847e30f30

                Download Submit