Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-03-2024 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3d926464a271358bfd08632b8fea021.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
d3d926464a271358bfd08632b8fea021.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
d3d926464a271358bfd08632b8fea021.exe
-
Size
68KB
-
MD5
d3d926464a271358bfd08632b8fea021
-
SHA1
cff41c9c90782aba9f9cd92238218f2d57f23642
-
SHA256
c64567bfed231a997651d6d7f8af3d4fabfe6b482b9f3c9f6c4676c54a13ae73
-
SHA512
eb397fe41ba691854ba10e5f4acd482359443b7d5c70155bd28d88b9b834151a68d6b1a18720380eccef43f7fd84c0f0c17ba85584c78bc133f9125d319797d3
-
SSDEEP
1536:SCNsGtB6krATUB4opT8f6aXf2tdphkAZJJA/M7Zjje5Z:SCNLG+pT8Japh3Z8/YxC5Z
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 3020 d3d926464a271358bfd08632b8fea021.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\efdedcsys = "rundll32.exe \"awwwwv.dll\",s" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\wvvwussys = "rundll32.exe \"awwwwv.dll\",s" rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\awwwwv.dll d3d926464a271358bfd08632b8fea021.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe Token: SeDebugPrivilege 2740 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2740 3020 d3d926464a271358bfd08632b8fea021.exe 28 PID 3020 wrote to memory of 2740 3020 d3d926464a271358bfd08632b8fea021.exe 28 PID 3020 wrote to memory of 2740 3020 d3d926464a271358bfd08632b8fea021.exe 28 PID 3020 wrote to memory of 2740 3020 d3d926464a271358bfd08632b8fea021.exe 28 PID 3020 wrote to memory of 2740 3020 d3d926464a271358bfd08632b8fea021.exe 28 PID 3020 wrote to memory of 2740 3020 d3d926464a271358bfd08632b8fea021.exe 28 PID 3020 wrote to memory of 2740 3020 d3d926464a271358bfd08632b8fea021.exe 28 PID 2740 wrote to memory of 388 2740 rundll32.exe 4 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 424 2740 rundll32.exe 5 PID 2740 wrote to memory of 1124 2740 rundll32.exe 19 PID 2740 wrote to memory of 1180 2740 rundll32.exe 20 PID 2740 wrote to memory of 3020 2740 rundll32.exe 27 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21 PID 2740 wrote to memory of 1276 2740 rundll32.exe 21
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:388
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:424
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\d3d926464a271358bfd08632b8fea021.exe"C:\Users\Admin\AppData\Local\Temp\d3d926464a271358bfd08632b8fea021.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\system32\awwwwv.dll",s3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD552553b170bce448957a2cccf8ce0a8fd
SHA1af2bcf306b7f82925fd74b9f31a1eb77aec9501a
SHA256bea342e7bd420cfc52f5336a36f2f185a822e2dd83f3a32d5ec93b77bade9188
SHA51256882032b1a9b0d9712f99cd2e14a9e483936d5cb3ab471174db964d8a43ec003d5ba6dbf3513517e0871e7021fc29203341b23569df68af3bdb34500c35dd42