6ce49155403f37a5c7808e0f4526d8ad43dd250b8278a79d7c21af790add66fc

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b148779aad21dfd3837686ff9997787.dll
Size

89KB
MD5

2b148779aad21dfd3837686ff9997787
SHA1

91e482ec6b60358b13db280786bf37bd37c613dc
SHA256

6ce49155403f37a5c7808e0f4526d8ad43dd250b8278a79d7c21af790add66fc
SHA512

0537fbda164ea98d72844e40cc9fb8359663c2844c7054b523ead477b24590bd0e3111a352e5d42ec0533a2e1f8e73ff15d3b776ef1848613a60b1da2eed60f2
SSDEEP

1536:4PjZQ3xawGfOcnJa8885z4BjucXrfHjx74Ew:4j8IwFWJaRc0Bljx74Ew

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\/Û[J=\pARAMETERS\ServiceDll = "%SystemRoot%\\System32"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\/Û[J=\pARAMETERS\ServiceDll = "%SystemRoot%\\System32"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\/Û[J=\pARAMETERS\ServiceDll = "%SystemRoot%\\System32"	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	1244	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1244	832	rundll32.exe	28
PID 832 wrote to memory of 1244	832	rundll32.exe	28
PID 832 wrote to memory of 1244	832	rundll32.exe	28
PID 832 wrote to memory of 1244	832	rundll32.exe	28
PID 832 wrote to memory of 1244	832	rundll32.exe	28
PID 832 wrote to memory of 1244	832	rundll32.exe	28
PID 832 wrote to memory of 1244	832	rundll32.exe	28
PID 1244 wrote to memory of 2156	1244	rundll32.exe	29
PID 1244 wrote to memory of 2156	1244	rundll32.exe	29
PID 1244 wrote to memory of 2156	1244	rundll32.exe	29
PID 1244 wrote to memory of 2156	1244	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b148779aad21dfd3837686ff9997787.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b148779aad21dfd3837686ff9997787.dll,#1
  2⤵
  - Sets DLL path for service in the registry
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 340
    3⤵
    - Program crash
    PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads