Analysis
-
max time kernel
23s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
19/11/2023, 21:30
General
-
Target
c6fc9524fec2a6e2d2954d11b67a4d86a3c4a5672f21c388b1ab555e6fd09888.dll
-
Size
912KB
-
MD5
d24b38a543bfbb715b93e9059a79ada5
-
SHA1
af4b41a4ddd99d866360160f755a5f55fc8f35f0
-
SHA256
c6fc9524fec2a6e2d2954d11b67a4d86a3c4a5672f21c388b1ab555e6fd09888
-
SHA512
abceb1d12fc00678b63d2439341e04bdee65952230ebd6ba674d9a9b8b6fccea04fed1e4b9f1c8f2064c944b7f5b8d71749a7b2b343923d335a8bd03b5eb3830
-
SSDEEP
12288:v+YE32Q8n9FgCBT4jh0rOcazvLbzTq4TYSyPKcaTuxfa:vvEwnfg04jgaXbzG4TYS8KcR
Malware Config
Signatures
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6fc9524fec2a6e2d2954d11b67a4d86a3c4a5672f21c388b1ab555e6fd09888.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\XUDGFA.cmd1⤵
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\y99pX.cmd1⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "Ylmmmigwnqcj" /TR C:\Windows\system32\ha6GXf\SystemPropertiesComputerName.exe /SC minute /MO 60 /RL highest1⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Ylmmmigwnqcj"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Ylmmmigwnqcj"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Ylmmmigwnqcj"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Ylmmmigwnqcj"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Ylmmmigwnqcj"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231B
MD5a57a2ac764fce3263752149cf6040ed3
SHA1c80561474c8dd8e9fb0aa743cb1e66dcd578ba2d
SHA2561a06dd62f437c0f773e8abf90bebbc24fe4e0c1eaa2d25b64c6d3921dd7ceb9f
SHA5123e4fe652c45c8165e77fc67c7792230644f75af5bb480da78a287245ecb6741669677146f6e3ce68d7632e491bc05c179bc1d9038e0bf6c40a4dfce7716eafef
-
Filesize
916KB
MD5a601f7c0dad7aa2480f9cd70f83b50ed
SHA124e4960e2d9a09499a8190b11d29dcbac246e1fd
SHA25655caacc4e1bbd4e1a806fd99ccb692a4e95c95845fb9584f7f269d291c84fb33
SHA512bdc920231ea45d923b48e6518b19b4e4cb717fc58ba0e3c723edd7c82a509dc6a4bad72a42c2f79eb67e6de37d4e568f44afc13c8019d77e9cab3373d09bd3a8
-
Filesize
916KB
MD5779bdad65eba8d54ca0526bb97de250c
SHA134ec03245e70c33483e00f6b86e0d30d73369c1b
SHA2568a8cc3dd38b8c2d28faee5e201a0e94e071b9c47f72aed7029f630cbf54d0001
SHA5121519d0bd95560ad2298065f9cabe760688c7c1e6ef775af7ae18db9e26a12ac4c516d49a91a8b291d3c8d8dbfaee4101b22bd5214ce7a7cf2bf944564f430101
-
Filesize
217B
MD51e1217517f436006302892c32be66b2f
SHA1923628c0a9ea553c1bd7b122c6f3ccc4e6e4d2d0
SHA2561a2861a74e6b82f1d9333442d0d5029af873ba658f49002625cfb458ced32d26
SHA512050042eef24307cf8bd0c29ec16bbbeacda70ebc558e6a635304d666a13db48ec34ec1184eb19f5da704c1d213ed6755e65bbb5c9e02e04cbcc4c8168ee212d4
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
859B
MD5c1431bc72748dbcb273c1fb3f14a081f
SHA1a2b77504ba79c6261165897291b4180f5cafef00
SHA256b8c6b36e804c1f7bb765c4e66d9384244099b9de1f2987fedf741cf6d6f164c3
SHA5125257a67f63ebcd0dac2708a194106172b4798388e286e564f39dc43c1bf2ddc144319302d352ab3dda1f1a577f01ac16288b04655fefdf4a3fb84aefb9cc44fd
-
Filesize
32KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
32KB
-
Filesize
912KB
-
Filesize
64KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
4KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
912KB
-
Filesize
4KB