4fb409b42ecc1d03c557e804df5aba0ba721fc885e8b3e5b7032a2551275d4e0

General

Target

VirusShare_64f26f341dc59ee8c340fcae3ed2b4d5.dll
Size

2.1MB
MD5

64f26f341dc59ee8c340fcae3ed2b4d5
SHA1

5bf2a4d34959007c1d7d85b45f8a2c5801636cb6
SHA256

4fb409b42ecc1d03c557e804df5aba0ba721fc885e8b3e5b7032a2551275d4e0
SHA512

b54bafc839e722e79e213d4babc303b9b123dfa78a7f622864058a2e0f58cc81b360db22eea67ba843397599a43b630218543d758dd2afbf070f96453eef579e
SSDEEP

3072:da/fT8nSPDyBL4ORnMAhr1yw649iS3BAarBQ/sVsVuSOUwQka/:WT8nftDD/i+Aa1csmYSNp

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\Windows\\system32\\rundll32.exe C:\\PROGRA~3\\lopcowidll.dat,StartAs"	rundll32.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\PROGRA~3\lopcowidll.dat	rundll32.exe
File opened for modification	C:\PROGRA~3\lopcowidll.dat	rundll32.exe
File created	C:\PROGRA~3\lldiwocpol.dat	rundll32.exe
File opened for modification	C:\PROGRA~3\lldiwocpol.dat	rundll32.exe

Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	rundll32.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	rundll32.exe
3444	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3444	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 3444	404	rundll32.exe	84
PID 404 wrote to memory of 3444	404	rundll32.exe	84
PID 404 wrote to memory of 3444	404	rundll32.exe	84
PID 3444 wrote to memory of 3508	3444	rundll32.exe	60

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_64f26f341dc59ee8c340fcae3ed2b4d5.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_64f26f341dc59ee8c340fcae3ed2b4d5.dll,#1
    3⤵
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Modifies Internet Explorer Protected Mode
    - Modifies Internet Explorer Protected Mode Banner
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\lldiwocpol.dat

Filesize
15.7MB

MD5
bf4725fc0faf4278108fce2696ec1553

SHA1
2b53df9d9b9588a30b1dd98b695ea6b8d6fce44a

SHA256
dfc6d0bae02219f566a502b392fc20a36548ebdc72440a5235eb36f8f8786dee

SHA512
663e6c0e782aa0fb6fbd3af6ee228fe708e42a513ee774b7ea9a6039742f84980d73cdef053a8994d9821d9131fd488ab3e357d258daee144fc048928f927fb3

Download Submit
C:\PROGRA~3\lopcowidll.dat

Filesize
3.3MB

MD5
0470da26136b28512691a43f97403a78

SHA1
6d6c920a23e7b181279f6c1379d30f2690d1b52d

SHA256
f56da63de2199596273de7660844849abbad125ba0bc09e024b1512279b3e9bd

SHA512
05ac28ff66b398311920aea7111cecf7972e414ffe7b7d512996daa7cd3b2281854a235ac3592b2f65fde7227a8a08973c81006799c6bd98c11eb32ce7603044

Download Submit
memory/3444-0-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3444-1-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3444-2-0x0000000000AF0000-0x0000000000B3F000-memory.dmp

Filesize
316KB

Download
memory/3444-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3444-17-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3444-19-0x0000000000AF0000-0x0000000000B3F000-memory.dmp

Filesize
316KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads