e35de97992fd332255d0f43b8e6ff131f3a933008f994a3a4b4004f1067e4c96

Analysis

max time kernel
141s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1578de107e6df5ac383df0f04194ec1e.dll
Size

136KB
MD5

1578de107e6df5ac383df0f04194ec1e
SHA1

109ca4a264a15a556265f18e3ae768e3d0bda5dc
SHA256

e35de97992fd332255d0f43b8e6ff131f3a933008f994a3a4b4004f1067e4c96
SHA512

cdd8e796b726fbd6e92449cdd5257075bd665e68462d13c5f5181b698d4153274a203a9011bf7e8bbadef96aaab9b3601839767eb6572523c1ef29893e77955c
SSDEEP

3072:xAi3BAuTBxY4z1qkzdVBNC0cpvWVQLrY6khQNjrKxtR84:xXJBlz4kzvmbeUs

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\2acac080\imagepath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\5725.tmp"	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2892	2200	WerFault.exe	14

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2200	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2200	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2200	2220	rundll32.exe	14
PID 2220 wrote to memory of 2200	2220	rundll32.exe	14
PID 2220 wrote to memory of 2200	2220	rundll32.exe	14
PID 2220 wrote to memory of 2200	2220	rundll32.exe	14
PID 2220 wrote to memory of 2200	2220	rundll32.exe	14
PID 2220 wrote to memory of 2200	2220	rundll32.exe	14
PID 2220 wrote to memory of 2200	2220	rundll32.exe	14
PID 2200 wrote to memory of 2892	2200	rundll32.exe	20
PID 2200 wrote to memory of 2892	2200	rundll32.exe	20
PID 2200 wrote to memory of 2892	2200	rundll32.exe	20
PID 2200 wrote to memory of 2892	2200	rundll32.exe	20

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1578de107e6df5ac383df0f04194ec1e.dll,#1
1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 392
  2⤵
  - Program crash
  PID:2892

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1578de107e6df5ac383df0f04194ec1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-1-0x0000000000C50000-0x0000000000D50000-memory.dmp

Filesize
1024KB

Download
memory/2200-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2200-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2200-6-0x0000000000C50000-0x0000000000D50000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads