Analysis
-
max time kernel
142s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
27/08/2023, 15:42
General
-
Target
c1be4671b4f67c1902f14a732f0ea283f90db889116ee1de310823ce12b04dda.dll
-
Size
1.7MB
-
MD5
a8150e096396092c58f7bb78a7e1484f
-
SHA1
e30e8b92824a9e3f351e1fa1fb66fb27cb0a679d
-
SHA256
c1be4671b4f67c1902f14a732f0ea283f90db889116ee1de310823ce12b04dda
-
SHA512
a5dc461a0b4d8fc79d341ddcd2f8f68bce187fe67ff0303fd8605e83b7d7e2496094cf1d2175ee7e8effef84d159f11ac1ba28cef0dafdfacc632a8ef7c323fd
-
SSDEEP
49152:QXYLbix0dEDr+F46sPGiRPHKZ7WOLh7livfKYhiBWOh:QXYLWWCXfxPGihKZli5QWs
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c1be4671b4f67c1902f14a732f0ea283f90db889116ee1de310823ce12b04dda.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c1be4671b4f67c1902f14a732f0ea283f90db889116ee1de310823ce12b04dda.dll,#12⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Public\Music\10.ps13⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Users\Public\Music\22.exeC:\Users\Public\Music\22.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c start C:\ProgramData\MonkeyKing4⤵
- Modifies registry class
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\gpedit.msc"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
592B
MD5f28d5da820677d92b40ab19ccc5a6795
SHA116423e998c5bae8b1004c7aa21ad1d44ae7cdee0
SHA2560ada0bc8f24cc25139e3ea2959f09a6fc0d18bb74fd45991b5ca239bda56588e
SHA51227d615853dc864e35364e71b0cd760becd36296e3b7bcfe9f75726088105464ad21e67ac42def50d466fd11bddf36c30efa0c3dae3e204bba8d126963c7c3d7b
-
Filesize
108KB
MD548c30975186d1e0e8e3f9b29b7d98321
SHA1dd0ad4e37b44c70204b64cb75adb0f937130105b
SHA2565aa75d506a8a0b066b402f9548e21c1f2b90c34facc0c38c651e382aa312ae54
SHA512559a77befe73b420a7f490b615f1ad1477a998b5a79f8e786dbc6cc691d8e09d7f6bd852f2f58feec5786367869339c787b28e1397fceb1f9fe83b378cfe107c
-
Filesize
108KB
MD548c30975186d1e0e8e3f9b29b7d98321
SHA1dd0ad4e37b44c70204b64cb75adb0f937130105b
SHA2565aa75d506a8a0b066b402f9548e21c1f2b90c34facc0c38c651e382aa312ae54
SHA512559a77befe73b420a7f490b615f1ad1477a998b5a79f8e786dbc6cc691d8e09d7f6bd852f2f58feec5786367869339c787b28e1397fceb1f9fe83b378cfe107c
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.6MB
-
Filesize
4.8MB
-
Filesize
960KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
144KB
-
Filesize
276KB
-
Filesize
1.5MB
-
Filesize
4.8MB
-
Filesize
296KB
-
Filesize
4.8MB
-
Filesize
48KB
-
Filesize
296KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
296KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB