fda45010d8297cf7afd9ebb35510cf2628daf5fb247f7dad2c765e91674e2b52

Analysis

max time kernel
172s
max time network
248s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

S3tupp__Pswrd--1231/cr.dll
Size

701.1MB
MD5

c25fc4a6a168b5d6ee832d0a0d594e72
SHA1

db1c13482637af9a638bdb28f867b5aa1714622d
SHA256

6ea2e795d258469f90f47cdb666b2d291e541376f2ca499a55d0b48353c70cb5
SHA512

c9c77809d9aec496a9851ba4953f3f6ecab40614fe3e9c13fe22c8489a1da91a195a07f9c7fad3dfaba1c6955a78d8b04780c42e9f725a8d70adb70bacb59707
SSDEEP

24576:1LTibD9P8rT21S6MYckrjZqIsN7g4F7rZr8Hxz5kWFiTT8Q:wD9P/Ah5G45KHxzO

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dwwin.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dwwin.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwwin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4940	dwwin.exe
Token: SeBackupPrivilege	4940	dwwin.exe
Token: SeBackupPrivilege	4940	dwwin.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3100	3060	rundll32.exe	88
PID 3060 wrote to memory of 3100	3060	rundll32.exe	88
PID 3060 wrote to memory of 3100	3060	rundll32.exe	88
PID 3100 wrote to memory of 4940	3100	rundll32.exe	108
PID 3100 wrote to memory of 4940	3100	rundll32.exe	108
PID 3100 wrote to memory of 4940	3100	rundll32.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\S3tupp__Pswrd--1231\cr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\S3tupp__Pswrd--1231\cr.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\SysWOW64\dwwin.exe
    -x -s 568
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3100-0-0x0000000075460000-0x000000007558B000-memory.dmp

Filesize
1.2MB

Download
memory/3100-3-0x0000000075460000-0x000000007558B000-memory.dmp

Filesize
1.2MB

Download
memory/3100-5-0x0000000077B22000-0x0000000077B23000-memory.dmp

Filesize
4KB

Download
memory/3100-6-0x0000000075460000-0x000000007558B000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads