96ca4cc3d47e4c189a8afd8e8ae5d20a3c489adb741576b68d837293f4522f3e

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2023 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0598e1af6466b0813030d44fa64616eea7f83957d70f2f48376202c3179bd6b1.dll
Size

280KB
MD5

a17d21baa4329d6affb6f0436efc3ce2
SHA1

12494915133ec45c8fd69ce7ce8c20cb53397f50
SHA256

0598e1af6466b0813030d44fa64616eea7f83957d70f2f48376202c3179bd6b1
SHA512

126fe72ce70a317dc96b5bd62c380a9db69f8602559d892cec68652683d66c3ed54d525b3854acb32a2a0a6c7f31ae22b0e4c4920235c958bc3eef2d61cbe1b7
SSDEEP

6144:otcSy3m09/6W2fL0jSH8Lns/wHAridF5n8lxFUF/Mhs1agQkk6eG8R:Uu/6LuJLns6Ari67FUFMs1agQkaGO

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 5072	868	rundll32.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5072	WWAHost.exe
5072	WWAHost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
868	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	WWAHost.exe
Token: SeManageVolumePrivilege	964	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 5072	868	rundll32.exe	85
PID 868 wrote to memory of 5072	868	rundll32.exe	85
PID 868 wrote to memory of 5072	868	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0598e1af6466b0813030d44fa64616eea7f83957d70f2f48376202c3179bd6b1.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\system32\WWAHost.exe
  C:\Windows\system32\WWAHost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5072

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-1-0x00007FFC01840000-0x00007FFC018FE000-memory.dmp

Filesize
760KB

Download
memory/868-0-0x00007FFC03750000-0x00007FFC03945000-memory.dmp

Filesize
2.0MB

Download
memory/964-41-0x00000174D3650000-0x00000174D3660000-memory.dmp

Filesize
64KB

Download
memory/964-61-0x00000174DBB00000-0x00000174DBB01000-memory.dmp

Filesize
4KB

Download
memory/964-60-0x00000174DB9F0000-0x00000174DB9F1000-memory.dmp

Filesize
4KB

Download
memory/964-59-0x00000174DB9F0000-0x00000174DB9F1000-memory.dmp

Filesize
4KB

Download
memory/964-57-0x00000174DB9C0000-0x00000174DB9C1000-memory.dmp

Filesize
4KB

Download
memory/5072-3-0x00007FFC03750000-0x00007FFC03945000-memory.dmp

Filesize
2.0MB

Download
memory/5072-13-0x0000020FF8410000-0x0000020FF8450000-memory.dmp

Filesize
256KB

Download
memory/5072-15-0x0000020FFA690000-0x0000020FFA6A0000-memory.dmp

Filesize
64KB

Download
memory/5072-16-0x0000020FF8450000-0x0000020FF8456000-memory.dmp

Filesize
24KB

Download
memory/5072-21-0x00007FFBE5640000-0x00007FFBE6101000-memory.dmp

Filesize
10.8MB

Download
memory/5072-22-0x0000020FFA690000-0x0000020FFA6A0000-memory.dmp

Filesize
64KB

Download
memory/5072-23-0x0000020FFA690000-0x0000020FFA6A0000-memory.dmp

Filesize
64KB

Download
memory/5072-24-0x0000020FFA690000-0x0000020FFA6A0000-memory.dmp

Filesize
64KB

Download
memory/5072-14-0x0000020FFA690000-0x0000020FFA6A0000-memory.dmp

Filesize
64KB

Download
memory/5072-12-0x00007FFBE5640000-0x00007FFBE6101000-memory.dmp

Filesize
10.8MB

Download
memory/5072-6-0x0000000180000000-0x0000000180041000-memory.dmp

Filesize
260KB

Download
memory/5072-4-0x00007FFC01840000-0x00007FFC018FE000-memory.dmp

Filesize
760KB

Download
memory/5072-2-0x0000020FF7D90000-0x0000020FF7DD3000-memory.dmp

Filesize
268KB

Download