Analysis
-
max time kernel
67s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
01/04/2023, 19:24
General
-
Target
e29412d1cb7924766bc5ade31eadde6f157f30f9b6174aad217400c4b45ce197.dll
-
Size
3.4MB
-
MD5
69a01415c4b3b990933b47351380127c
-
SHA1
7a9051b8be45853594a6952a43798f6a7702a8c3
-
SHA256
e29412d1cb7924766bc5ade31eadde6f157f30f9b6174aad217400c4b45ce197
-
SHA512
368ca8a1f28a70e460df9686385d0ca7453183406e3467376759bb8f85b57f2adb1e5f6b9fb4b0da48f3f9dd44df0629eabc2f8a2b509a6de4a50769a2b07a04
-
SSDEEP
24576:+V76pHUQnEXcfsfzHh/esoSPkzEcUwT6uSms+jgNb0JxGrurooa+AwhhfO8EPPPs:+V7mCV7jW228PPagxnGBluChwQpzIKX
Malware Config
Signatures
-
Drops file in Drivers directory 8 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 32 IoCs
-
Drops file in Windows directory 13 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e29412d1cb7924766bc5ade31eadde6f157f30f9b6174aad217400c4b45ce197.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e29412d1cb7924766bc5ade31eadde6f157f30f9b6174aad217400c4b45ce197.dll,#12⤵
- Sets service image path in registry
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\Driver_Setup.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exedevcon install VmtkmHid_0.inf "{8FBC4165-480D-4230-B1DF-7B86F3E5A3CC}\HID_DEVICE"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\FileDef20160419\x64\devcon.exedevcon update VmtkmMouFiltr_0.inf "HID\Vid_1bcf&Pid_05e3&Col02"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1d9d1a73-8eac-3449-a0a5-5617c349845c}\vmtkmhid_0.inf" "9" "4f780c9bb" "00000000000000B8" "WinSta0\Default" "0000000000000140" "208" "c:\users\admin\appdata\local\temp\filedef20160419\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:b2fe4818386da1dc:VHidMini.Inst:1.0.0.1:{8fbc4165-480d-4230-b1df-7b86f3e5a3cc}\hid_device," "4f780c9bb" "00000000000000B8"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1c9c308a-e678-8648-a995-24d14538c582}\vmtkmmoufiltr_0.inf" "9" "458dbf7d3" "0000000000000170" "WinSta0\Default" "0000000000000174" "208" "c:\users\admin\appdata\local\temp\filedef20160419\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "HID\VID_1BCF&PID_05E3&COL02\1&2D595CA7&0&0001" "C:\Windows\INF\oem4.inf" "oem4.inf:bcec1b19d8f58feb:HIDUAS_Inst:1.0.0.0:hid\vid_1bcf&pid_05e3&col02," "458dbf7d3" "0000000000000170"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s hidserv1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5ffb0bbd1166100b72cc3823baa152b2f
SHA1dab9d0aee5ab7f2995feeacdbc6bf7710a372f0f
SHA256f107b57123cb427fce8d635f19e63483819d48876adf9ddc05174af80cce4229
SHA512dabe236a5df5f7d62dc8df9d8c8faf6ef27db96c43caf61d13aba5e9e9f82a5f9aa5e1fa92d239580da7e62356991c6e76f9884c66380f0e53cac68a89658fec
-
Filesize
148B
MD5ffb0bbd1166100b72cc3823baa152b2f
SHA1dab9d0aee5ab7f2995feeacdbc6bf7710a372f0f
SHA256f107b57123cb427fce8d635f19e63483819d48876adf9ddc05174af80cce4229
SHA512dabe236a5df5f7d62dc8df9d8c8faf6ef27db96c43caf61d13aba5e9e9f82a5f9aa5e1fa92d239580da7e62356991c6e76f9884c66380f0e53cac68a89658fec
-
Filesize
3KB
MD5ac2a7db4b61118498e6d74e302335c2b
SHA185da16e595b994cd6e3cdcedc2ae2e5068a5640e
SHA25620ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0
SHA51225b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0
-
Filesize
87KB
MD541ba1bbdd9284e49701ee94a3f446c33
SHA16d5bd532a0f9a3bf7005edeb53b4aba2d30a0c99
SHA256c65d9acba88d2c56422ec4aba235b0ae25bb3261bf400cd30efe11de0c4330e4
SHA512dc55452698966b77c157a81eb458984b17e3e3a0d3ff885479f7c823b847eb739a07782f140ced12eac75fdddd7416f923c885a9d8e8b0a10010fc07bef3da45
-
Filesize
87KB
MD541ba1bbdd9284e49701ee94a3f446c33
SHA16d5bd532a0f9a3bf7005edeb53b4aba2d30a0c99
SHA256c65d9acba88d2c56422ec4aba235b0ae25bb3261bf400cd30efe11de0c4330e4
SHA512dc55452698966b77c157a81eb458984b17e3e3a0d3ff885479f7c823b847eb739a07782f140ced12eac75fdddd7416f923c885a9d8e8b0a10010fc07bef3da45
-
Filesize
87KB
MD541ba1bbdd9284e49701ee94a3f446c33
SHA16d5bd532a0f9a3bf7005edeb53b4aba2d30a0c99
SHA256c65d9acba88d2c56422ec4aba235b0ae25bb3261bf400cd30efe11de0c4330e4
SHA512dc55452698966b77c157a81eb458984b17e3e3a0d3ff885479f7c823b847eb739a07782f140ced12eac75fdddd7416f923c885a9d8e8b0a10010fc07bef3da45
-
Filesize
8KB
MD569d398d45035ea070ad1d950947b8258
SHA1f389482e8f547f08f6637005cb0312ab1c94a9cb
SHA256f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097
SHA5126186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be
-
Filesize
7KB
MD53eb7619b8440e9a003c4a5a9b8acde33
SHA15c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f
SHA256784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0
SHA512eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5
-
Filesize
8KB
MD569d398d45035ea070ad1d950947b8258
SHA1f389482e8f547f08f6637005cb0312ab1c94a9cb
SHA256f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097
SHA5126186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be
-
Filesize
11KB
MD515be41abe19a4c66d9e94ff5afee1822
SHA1e47dca6ade9843a5ee6d6f100d12bcc06bee5f06
SHA256da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb
SHA512dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41
-
Filesize
2KB
MD5c96843464c7474150b481cb5f0075c22
SHA19fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5
SHA256006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40
SHA512303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4
-
Filesize
2KB
MD5c96843464c7474150b481cb5f0075c22
SHA19fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5
SHA256006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40
SHA512303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4
-
Filesize
3KB
MD5ac2a7db4b61118498e6d74e302335c2b
SHA185da16e595b994cd6e3cdcedc2ae2e5068a5640e
SHA25620ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0
SHA51225b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0
-
Filesize
3KB
MD5ac2a7db4b61118498e6d74e302335c2b
SHA185da16e595b994cd6e3cdcedc2ae2e5068a5640e
SHA25620ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0
SHA51225b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0
-
Filesize
3KB
MD5ac2a7db4b61118498e6d74e302335c2b
SHA185da16e595b994cd6e3cdcedc2ae2e5068a5640e
SHA25620ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0
SHA51225b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0
-
Filesize
2KB
MD5c96843464c7474150b481cb5f0075c22
SHA19fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5
SHA256006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40
SHA512303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4
-
Filesize
146KB
MD59af209754453a04f64d1948cf9f7a7a4
SHA1a37bb4a00c522c9f3dfa29bc1e6aeb5c0a2f3a54
SHA2564dedd1155e8fc236e61f6beff6768520b0269be3a6f171be40ca90fa6b138dd8
SHA5121117448dedd0d07e4ecbb387abf50a6a97a196816ffde9c5aab3352074250eee8174ad1206fa10b9144ddf3b68ef0e6dafac841a5964f96a06166f06d16d7858
-
Filesize
11KB
MD515be41abe19a4c66d9e94ff5afee1822
SHA1e47dca6ade9843a5ee6d6f100d12bcc06bee5f06
SHA256da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb
SHA512dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41
-
Filesize
7KB
MD53eb7619b8440e9a003c4a5a9b8acde33
SHA15c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f
SHA256784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0
SHA512eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5
-
Filesize
3KB
MD5ac2a7db4b61118498e6d74e302335c2b
SHA185da16e595b994cd6e3cdcedc2ae2e5068a5640e
SHA25620ba09ccf6d435af296bbe9e84212538094ea064128052d737f6884265de05d0
SHA51225b0ab141032643e7c871066d909b4e331991d55ec602c6b4166ffbab3aa43a1535aae92159ac16d7fb81c5885c3f26518b5b4c2224dd26ac8534f349b2898e0
-
Filesize
2KB
MD5c96843464c7474150b481cb5f0075c22
SHA19fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5
SHA256006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40
SHA512303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4
-
Filesize
8KB
MD569d398d45035ea070ad1d950947b8258
SHA1f389482e8f547f08f6637005cb0312ab1c94a9cb
SHA256f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097
SHA5126186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be
-
Filesize
11KB
MD515be41abe19a4c66d9e94ff5afee1822
SHA1e47dca6ade9843a5ee6d6f100d12bcc06bee5f06
SHA256da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb
SHA512dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41
-
Filesize
7KB
MD53eb7619b8440e9a003c4a5a9b8acde33
SHA15c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f
SHA256784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0
SHA512eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5
-
Filesize
11KB
MD515be41abe19a4c66d9e94ff5afee1822
SHA1e47dca6ade9843a5ee6d6f100d12bcc06bee5f06
SHA256da484327e2601a56f90d2ad2a040150171548fe8aeac8332c8f27c9ac6054fbb
SHA512dcec2d963cee7c26190686c93cd28b4fa17d4c54ca0cf1e231603dc445a17685f43d4fab5e0d1e6b1e6b2bc8aac5617542068064d9639f150e6e77e2e2709c41
-
Filesize
7KB
MD53eb7619b8440e9a003c4a5a9b8acde33
SHA15c1d6bbe9ac62e8ce9bb5432b711fdc2e4e3b94f
SHA256784287759ef05e815b2c486f7bc6af5077d1c9c86c4ef921e8b2039634f667a0
SHA512eaa73dd2e6a65dff50b6a1ae1b3c3155e68849c5339c89d543e58b4ac34dbd4173e00d6deaf12b47bfe491cd001f0f3b04634364a4fb0acc73070da10ae7a0f5
-
Filesize
8KB
MD569d398d45035ea070ad1d950947b8258
SHA1f389482e8f547f08f6637005cb0312ab1c94a9cb
SHA256f966ccfc34fca47aa0f8de37ea7eba2d89c7db14db408a20ad9cdbc28ddda097
SHA5126186f36982795d116da883769458c74e63a0719a78026f2343e2ba0ff27367d028f72a880e07ca894e8f67aed4f758a41a386bab358cbf18eff51326119d80be
-
Filesize
2KB
MD5c96843464c7474150b481cb5f0075c22
SHA19fb1a53cbe5c6e9adcb3fd061fc9f292a648a1e5
SHA256006850d8035f5e776c34ceaf90d292b8ff83e9457e5b32e118e6d5b4a755ca40
SHA512303bd7f8e9c04f755eb3e0bce867a16be10dbfccc25e98e4e12fa9d51241bb67e27dcac8c0ec0eebc1a20c043cd3e78e0766b879b3ffb69e00bdfe31f07dc0d4
-
Filesize
240KB
-
Filesize
764KB