6a39e41394e418f1d96fdded86c1a994ce359c4cfb943daad3cb97125c25f6ab

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 13:59

Target

wwlib.dll
Size

26KB
MD5

f20ca31b829252aecabeae7ba2e3ec60
SHA1

2a06a4538bb981c33f64a28bdfefdbf6b536aba0
SHA256

6a39e41394e418f1d96fdded86c1a994ce359c4cfb943daad3cb97125c25f6ab
SHA512

42b7b68e141076382cca744ebc5ebb27e886e4cf8d2530e0e8e69bbaafc182e62fd16db17aa6f1223b679054ff9ee0baa4caa5c1a8124008eb5bca0351b91341
SSDEEP

384:h2EYLKywcbyMIRp7NH10MI6aCI2Ldnc/+h/rI//EZYGo9RsTZeGgaRZBpAG3YF8l:BYLl7IvBZZwuTg1IjAGYDROcRZS

Score

10^/10

persistence

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, explorer.exe /e,/root,%Pyps% -nop -w h \"Start-Process -N -F $env:Msbd -A $env:Temprd\""	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

SCHTASKS.exe

pid process

2480 SCHTASKS.exe

pid	process
2480	SCHTASKS.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2216 wrote to memory of 2480	2216	rundll32.exe	SCHTASKS.exe
PID 2216 wrote to memory of 2480	2216	rundll32.exe	SCHTASKS.exe
PID 2216 wrote to memory of 2480	2216	rundll32.exe	SCHTASKS.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\SCHTASKS.exe
SCHTASKS /CREATE /f /TN "OneDriver Reporting Task" /TR "shutdown /l /f" /SC WEEKLY /d TUE,FRI /ST 12:35
2⤵
- Creates scheduled task(s)
PID:2480