dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e6ac23cf16f054b9b79ccbe0e486f82.dll
Size

299KB
MD5

4e6ac23cf16f054b9b79ccbe0e486f82
SHA1

0c4572af283c893d87c6040b795150ab55ec0577
SHA256

dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c
SHA512

73327aaa38b9949219f2d19358f8a8b217d0022483af19acaf75ee3c702205bfbb58915462c7f8760bd27a5ea972b8e7118b572d37c954a2ebb53c672c171817
SSDEEP

6144:rTW3YgVzMS73tzrVmSavGXQ+90sGjGms4+/NoNZra8dOJCUJUeANlq:rTW3YmzMc3tzrVmLvGA5sGimst/NQ/U7

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\rundll32.exe: $TASK	rundll32.exe
File opened for modification	C:\Windows\system32\rundll32.exe: $FILE	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1172	taskeng.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1180	1172	taskeng.exe	31
PID 1172 wrote to memory of 1180	1172	taskeng.exe	31
PID 1172 wrote to memory of 1180	1172	taskeng.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e6ac23cf16f054b9b79ccbe0e486f82.dll,#1
1⤵
- Drops file in System32 directory
PID:2436

C:\Windows\system32\taskeng.exe
taskeng.exe {0B37E2FC-E9EF-4E73-8D80-F1059FF3C46F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe -u
  2⤵
  PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...