Analysis
-
max time kernel
73s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 14:53
Static task
static1
Behavioral task
behavioral1
Sample
6ee397be7161e5dbeff42fab80346d0d07257b2dffe1138f1f5f92fa2c09e258.dll
Resource
win10v2004-20230221-en
General
-
Target
6ee397be7161e5dbeff42fab80346d0d07257b2dffe1138f1f5f92fa2c09e258.dll
-
Size
16KB
-
MD5
a90cedc78c9fadd943586c7e0f702365
-
SHA1
c4708a36513e3112f959ffcfe33534a949f3ef1d
-
SHA256
6ee397be7161e5dbeff42fab80346d0d07257b2dffe1138f1f5f92fa2c09e258
-
SHA512
674106b56265d13ff090c6c6e7633ba4e0cdd765072b90ef28c3603c703af47db09ad756bb0e21b88de79a09d94c1f6372636a6b82ea6ce6d05dc46cfbd24a11
-
SSDEEP
192:1OIt31YVamI3X3PGR6ylM402ZJZ8d9iiiiiiiTSNNVJ8im6XS+XSyyd:1V91fm4nPG5KqjCdiwNVvSmSy
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1176-163-0x0000000010000000-0x0000000010040000-memory.dmp purplefox_rootkit behavioral1/memory/1176-164-0x0000000010000000-0x0000000010040000-memory.dmp purplefox_rootkit behavioral1/memory/1176-165-0x0000000010000000-0x0000000010040000-memory.dmp purplefox_rootkit -
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 4 1176 rundll32.exe 7 1176 rundll32.exe 27 1176 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/1176-160-0x0000000010000000-0x0000000010040000-memory.dmp upx behavioral1/memory/1176-163-0x0000000010000000-0x0000000010040000-memory.dmp upx behavioral1/memory/1176-164-0x0000000010000000-0x0000000010040000-memory.dmp upx behavioral1/memory/1176-165-0x0000000010000000-0x0000000010040000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ϵͳÀ¶ÆÁÐÞ¸´ = "C:\\Windows\\SysWOW64\\rundll32.exe" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\S: rundll32.exe -
Drops file in System32 directory 11 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3312 taskkill.exe -
Modifies registry class 2 IoCs
Processes:
explorer.exemspaint.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings mspaint.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
mspaint.exerundll32.exepid process 3180 mspaint.exe 3180 mspaint.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 3312 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mspaint.exeOpenWith.exepid process 3180 mspaint.exe 4176 OpenWith.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
rundll32.exerundll32.execmd.exeexplorer.exedescription pid process target process PID 2736 wrote to memory of 1176 2736 rundll32.exe rundll32.exe PID 2736 wrote to memory of 1176 2736 rundll32.exe rundll32.exe PID 2736 wrote to memory of 1176 2736 rundll32.exe rundll32.exe PID 1176 wrote to memory of 5008 1176 rundll32.exe explorer.exe PID 1176 wrote to memory of 5008 1176 rundll32.exe explorer.exe PID 1176 wrote to memory of 5008 1176 rundll32.exe explorer.exe PID 1176 wrote to memory of 4536 1176 rundll32.exe cmd.exe PID 1176 wrote to memory of 4536 1176 rundll32.exe cmd.exe PID 1176 wrote to memory of 4536 1176 rundll32.exe cmd.exe PID 4536 wrote to memory of 3312 4536 cmd.exe taskkill.exe PID 4536 wrote to memory of 3312 4536 cmd.exe taskkill.exe PID 4536 wrote to memory of 3312 4536 cmd.exe taskkill.exe PID 864 wrote to memory of 3180 864 explorer.exe mspaint.exe PID 864 wrote to memory of 3180 864 explorer.exe mspaint.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6ee397be7161e5dbeff42fab80346d0d07257b2dffe1138f1f5f92fa2c09e258.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6ee397be7161e5dbeff42fab80346d0d07257b2dffe1138f1f5f92fa2c09e258.dll,#12⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\Users\Public\Downloads\1.JPG3⤵PID:5008
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im hh.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im hh.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Public\Downloads\1.JPG" /ForceBootstrapPaint3D2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3180
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
PID:3432
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4176
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Downloads\1.JPGFilesize
102KB
MD5e0e247b326e27324551e1514e6815f7d
SHA16bc8e157ab59c032fc5b28f5c573d462dcef54c2
SHA2560eee81df330948e743bba1bd68ef0b00febfd44cdd6d0ace41ca74cdafc5c39d
SHA512579efdd583953e398eab9160a7d2584a4db88c00213f3d7ce4b4cb3019fd603dca466704a20305e4fa8320bac2f3b99429295dab2ef843a1b308f3be7f998c4a
-
memory/1176-165-0x0000000010000000-0x0000000010040000-memory.dmpFilesize
256KB
-
memory/1176-164-0x0000000010000000-0x0000000010040000-memory.dmpFilesize
256KB
-
memory/1176-163-0x0000000010000000-0x0000000010040000-memory.dmpFilesize
256KB
-
memory/1176-160-0x0000000010000000-0x0000000010040000-memory.dmpFilesize
256KB
-
memory/1176-159-0x00000000026B0000-0x00000000026FF000-memory.dmpFilesize
316KB
-
memory/3432-154-0x000001C912EF0000-0x000001C912EF1000-memory.dmpFilesize
4KB
-
memory/3432-155-0x000001C912F00000-0x000001C912F01000-memory.dmpFilesize
4KB
-
memory/3432-156-0x000001C912F00000-0x000001C912F01000-memory.dmpFilesize
4KB
-
memory/3432-157-0x000001C912F00000-0x000001C912F01000-memory.dmpFilesize
4KB
-
memory/3432-153-0x000001C912E60000-0x000001C912E61000-memory.dmpFilesize
4KB
-
memory/3432-151-0x000001C912E60000-0x000001C912E61000-memory.dmpFilesize
4KB
-
memory/3432-149-0x000001C912DE0000-0x000001C912DE1000-memory.dmpFilesize
4KB
-
memory/3432-142-0x000001C90A190000-0x000001C90A1A0000-memory.dmpFilesize
64KB
-
memory/3432-138-0x000001C90A150000-0x000001C90A160000-memory.dmpFilesize
64KB