7b2f7c4b6a2f9c969494bd10cb8ae5c4bbc75a1a17b7e69cea6386e25f893ec0

Analysis

max time kernel
145s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2023 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9862bf2cbe8d279fbd1551a98f9114b.dll
Size

269KB
MD5

a9862bf2cbe8d279fbd1551a98f9114b
SHA1

767a686d72c965781a93e311f34730bed3c431f1
SHA256

7b2f7c4b6a2f9c969494bd10cb8ae5c4bbc75a1a17b7e69cea6386e25f893ec0
SHA512

e327f7b7f766c5b7587887bd5726a2016c51f6e9d878d13cbc99d68235cc3ff4b53cadbdc251eac41ee143b7b4b84e715879ffc6806153136849416911335e18
SSDEEP

6144:FTdochbDK1aPyNaotanzwDH/yvjEp5ERAPzBn5aNyP7VL:MxioIzwijEkGhMeVL

Score

7^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\CLSID\{2222222222222}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\CLSID\{2222222222222}\InprocServer32\ = "C:\\Users\\george\\AppData\\Local\\Temp\\MSServerTypeLib7230343.dat"	rundll32.exe

Modifies registry class 5 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\CLSID\{2222222222222}\InprocServer32	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\CLSID	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\CLSID\{2222222222222}	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\CLSID\{2222222222222}\InprocServer32\ = "C:\\Users\\george\\AppData\\Local\\Temp\\MSServerTypeLib7230343.dat"	rundll32.exe
Key renamed	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\CLSID\{2222222222222}	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9862bf2cbe8d279fbd1551a98f9114b.dll,#1
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads