b32a3a86c30974f1307ac3204e6bf9ba6f2880d9a09482a6bd2e7c60a8c98c9e

Analysis

max time kernel
127s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2023, 06:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a449aa3971e54d072641e91c37037308.exe
Size 2.7MB
Sample230810-g7rn6aae82
SHA256 b32a3a86c30974f1307ac3204e6bf9ba6f2880d9a09482a6bd2e7c60a8c98c9e
MD5 a449aa3971e54d072641e91c37037308
SHA1 aa526e650ae821f599eda9d53fb8b363d141f430
SHA512 5e4daf1a44dfc937302a82849deb08eecb3464959837c590ec966ccfd30dfeafbe88f1772f57121524763b770988a3ebcacf45fcefdcb1bcde9b35fd3a91e551
SSDEEP 49152:2WhlHLBfJXAE9mjdl5xzir8/nGnH0HS1FjCkBqYl27H2C74JaDEqfnmOQZokyUbC:2WhlrBfKE2dlDirECHlTjCkFl2T2C7Tv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1836	rundll32.exe
700	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	a449aa3971e54d072641e91c37037308.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 1448	3752	a449aa3971e54d072641e91c37037308.exe	82
PID 3752 wrote to memory of 1448	3752	a449aa3971e54d072641e91c37037308.exe	82
PID 3752 wrote to memory of 1448	3752	a449aa3971e54d072641e91c37037308.exe	82
PID 1448 wrote to memory of 1836	1448	control.exe	85
PID 1448 wrote to memory of 1836	1448	control.exe	85
PID 1448 wrote to memory of 1836	1448	control.exe	85
PID 1836 wrote to memory of 4852	1836	rundll32.exe	91
PID 1836 wrote to memory of 4852	1836	rundll32.exe	91
PID 4852 wrote to memory of 700	4852	RunDll32.exe	92
PID 4852 wrote to memory of 700	4852	RunDll32.exe	92
PID 4852 wrote to memory of 700	4852	RunDll32.exe	92

C:\Users\Admin\AppData\Local\Temp\a449aa3971e54d072641e91c37037308.exe
"C:\Users\Admin\AppData\Local\Temp\a449aa3971e54d072641e91c37037308.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\YVY6jR.Cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\YVY6jR.Cpl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\YVY6jR.Cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\YVY6jR.Cpl",
        5⤵
        Loads dropped DLL
        
        PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

YVY6jR.Cpl

Path C:\Users\Admin\AppData\Local\Temp\YVY6jR.Cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvY6jR.cpl

Path C:\Users\Admin\AppData\Local\Temp\yvY6jR.cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvY6jR.cpl

Path C:\Users\Admin\AppData\Local\Temp\yvY6jR.cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

yvY6jR.cpl

Path C:\Users\Admin\AppData\Local\Temp\yvY6jR.cpl
Size 2.3MB
SHA256 190c520adbe98aa00bd7b7b1ee58ab1a5b0529a3c1743ee7b1f9667c1a0d264c
MD5 96400b560248368ba579ffc77e67773a
SHA1 29a4ff2a0395bcacbd1cdc05f69bb24837133258
SHA512 a83346bdb768d49edf8172b764aaf84db563c2d0a534edd593c1dec981e9a8c5234b78fbf74260ca224c09d2e65f0e1d9dc1136d2d16dd41a747e6ca87247ab8
SSDEEP 49152:D4ytAK2SkUDPyDRVxYM+bLM2VUmnmZhpSmxPEczSQf+6pb+8qvU:OK2q+RAXciUrZhpryiSQfjqvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/700-162-0x00000000036D0000-0x00000000037B4000-memory.dmp

Download

memory/700-161-0x00000000036D0000-0x00000000037B4000-memory.dmp

Download

memory/700-158-0x00000000036D0000-0x00000000037B4000-memory.dmp

Download

memory/700-157-0x00000000035D0000-0x00000000036CC000-memory.dmp

Download

memory/700-155-0x0000000002DA0000-0x0000000002DA6000-memory.dmp

Download

memory/1836-144-0x00000000032F0000-0x00000000032F6000-memory.dmp

Download

memory/1836-152-0x0000000003790000-0x0000000003874000-memory.dmp

Download

memory/1836-151-0x0000000003790000-0x0000000003874000-memory.dmp

Download

memory/1836-148-0x0000000003790000-0x0000000003874000-memory.dmp

Download

memory/1836-147-0x0000000003690000-0x000000000378C000-memory.dmp

Download

memory/1836-145-0x0000000000400000-0x0000000000643000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads