6a39e41394e418f1d96fdded86c1a994ce359c4cfb943daad3cb97125c25f6ab

Analysis

max time kernel
138s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 13:59

Target

wwlib.dll
Size

26KB
MD5

f20ca31b829252aecabeae7ba2e3ec60
SHA1

2a06a4538bb981c33f64a28bdfefdbf6b536aba0
SHA256

6a39e41394e418f1d96fdded86c1a994ce359c4cfb943daad3cb97125c25f6ab
SHA512

42b7b68e141076382cca744ebc5ebb27e886e4cf8d2530e0e8e69bbaafc182e62fd16db17aa6f1223b679054ff9ee0baa4caa5c1a8124008eb5bca0351b91341
SSDEEP

384:h2EYLKywcbyMIRp7NH10MI6aCI2Ldnc/+h/rI//EZYGo9RsTZeGgaRZBpAG3YF8l:BYLl7IvBZZwuTg1IjAGYDROcRZS

Score

10^/10

persistence

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, explorer.exe /e,/root,%Pyps% -nop -w h \"Start-Process -N -F $env:Msbd -A $env:Temprd\""	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
5024	SCHTASKS.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 5024	4108	rundll32.exe	85
PID 4108 wrote to memory of 5024	4108	rundll32.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wwlib.dll,#1
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\system32\SCHTASKS.exe
  SCHTASKS /CREATE /f /TN "OneDriver Reporting Task" /TR "shutdown /l /f" /SC WEEKLY /d TUE,FRI /ST 12:35
  2⤵
  - Creates scheduled task(s)
  PID:5024