Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-03-2024 19:45
Static task
static1
Behavioral task
behavioral1
Sample
4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll
Resource
win10v2004-20231215-en
General
-
Target
4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll
-
Size
339KB
-
MD5
a7c4c1c4fabf6dc0f5702f73083f3e46
-
SHA1
99a705d77e1e442e04963e6295aa15b24e9c4db5
-
SHA256
4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2
-
SHA512
0379170d8b772bf3ab4a8292fbb136b5ab49b7b961175ebe77884e8c1b700643c9566b9b1da6e45945cf3f642dc13eed58ed318cdc6751cbc2942888fd989144
-
SSDEEP
6144:xJ7D5RtYutKWXfsMWxbsFMTk8YnpjAycXdBkA:PbtYapX0yrXA
Malware Config
Signatures
-
Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler\{52EB730C-730C-2EB7-30C9-D962EB740D95} rundll32.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0C851EA6-1DA6-C851-DA63-730C951EA73F} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0C851EA6-1DA6-C851-DA63-730C951EA73F}\ rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\NOOP.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\NOOP.dll rundll32.exe File created C:\Windows\SysWOW64\IIIJ.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\IIIJ.dll rundll32.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52EB730C-730C-2EB7-30C9-D962EB740D95}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C851EA6-1DA6-C851-DA63-730C951EA73F}\ rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C851EA6-1DA6-C851-DA63-730C951EA73F}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52EB730C-730C-2EB7-30C9-D962EB740D95}\ rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52EB730C-730C-2EB7-30C9-D962EB740D95}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52EB730C-730C-2EB7-30C9-D962EB740D95}\InprocServer32\ = "C:\\Windows\\SysWow64\\NOOP.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C851EA6-1DA6-C851-DA63-730C951EA73F} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C851EA6-1DA6-C851-DA63-730C951EA73F}\InprocServer32\ = "C:\\Windows\\SysWow64\\IIIJ.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0C851EA6-1DA6-C851-DA63-730C951EA73F}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{52EB730C-730C-2EB7-30C9-D962EB740D95} rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1192 wrote to memory of 2944 1192 rundll32.exe 28 PID 1192 wrote to memory of 2944 1192 rundll32.exe 28 PID 1192 wrote to memory of 2944 1192 rundll32.exe 28 PID 1192 wrote to memory of 2944 1192 rundll32.exe 28 PID 1192 wrote to memory of 2944 1192 rundll32.exe 28 PID 1192 wrote to memory of 2944 1192 rundll32.exe 28 PID 1192 wrote to memory of 2944 1192 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4e1bfc80b0afeb98eb5f6ff0454b7059f252d13f99708b9617f1379c5683cda2.dll,#12⤵
- Modifies Shared Task Scheduler registry keys
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
339KB
MD578f82703c28efdb3a11c140b987557dc
SHA182e6ca3c2b56f5132943f8c4f491aecda64276aa
SHA256074f60a48f770aae040277f84995fa9d10cf45002baf4641d1a3ed52dc4d6daf
SHA512db31097d3cb172ff1905ca54637d5082291ebf0cda27b770b8a476545a428934cf3338f5e18a1e66ffa21b93fe4e8df394aa0f98026948ecc0790f51332eb661