Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23-01-2024 13:59
Static task
static1
Behavioral task
behavioral1
Sample
wwlib.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
wwlib.dll
Resource
win10v2004-20231215-en
General
-
Target
wwlib.dll
-
Size
26KB
-
MD5
f20ca31b829252aecabeae7ba2e3ec60
-
SHA1
2a06a4538bb981c33f64a28bdfefdbf6b536aba0
-
SHA256
6a39e41394e418f1d96fdded86c1a994ce359c4cfb943daad3cb97125c25f6ab
-
SHA512
42b7b68e141076382cca744ebc5ebb27e886e4cf8d2530e0e8e69bbaafc182e62fd16db17aa6f1223b679054ff9ee0baa4caa5c1a8124008eb5bca0351b91341
-
SSDEEP
384:h2EYLKywcbyMIRp7NH10MI6aCI2Ldnc/+h/rI//EZYGo9RsTZeGgaRZBpAG3YF8l:BYLl7IvBZZwuTg1IjAGYDROcRZS
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, explorer.exe /e,/root,%Pyps% -nop -w h \"Start-Process -N -F $env:Msbd -A $env:Temprd\"" rundll32.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2216 wrote to memory of 2480 2216 rundll32.exe SCHTASKS.exe PID 2216 wrote to memory of 2480 2216 rundll32.exe SCHTASKS.exe PID 2216 wrote to memory of 2480 2216 rundll32.exe SCHTASKS.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\wwlib.dll,#11⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SCHTASKS.exeSCHTASKS /CREATE /f /TN "OneDriver Reporting Task" /TR "shutdown /l /f" /SC WEEKLY /d TUE,FRI /ST 12:352⤵
- Creates scheduled task(s)