48b3cc0799138804952d7804a326a9356b4713be099d09a03d315d6fa8a6df28

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2023, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

w32time.dll
Size

506KB
MD5

eb00241b230ba9db117300f7d387472c
SHA1

536ff9c3b171cabbb364483cd667a0af10ae10c8
SHA256

92a7c73e59789c5337ca4799924c8f84e5edb2e76b15abf927201553e4d9a19a
SHA512

9d48c68e6a207341457f83e1dca326c54e15e8c3333ba9e9978a2949fa30272fa6f6bf2705608c5074176d26c906bff50afa6d3d8f5de5a082d4d12f60f12a52
SSDEEP

6144:26iNJ0DU3xOrRijnKl9a8dNbCNv8krA2q7yuL8Ktf6EBOsLmTcZtxLntw2pYbq8a:26izwrinKDaONmHsx7yTkntAbq2waA

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\W32Time\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w32time.dll"	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\w32time.dll
1⤵
- Sets DLL path for service in the registry
PID:4484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads