Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01/06/2024, 19:49
General
-
Target
2c3624b1dc2d67d7c2d140b9c8a4a0a27f579c6c6093deec1ae6ee0fc7affe55.dll
-
Size
724KB
-
MD5
a8ea0f9cd8f0443d95a469a21917cd2e
-
SHA1
6dff61cae0cb97e9f9258d994f4a606f41fd1e97
-
SHA256
2c3624b1dc2d67d7c2d140b9c8a4a0a27f579c6c6093deec1ae6ee0fc7affe55
-
SHA512
a3a0a3f3c9b5f9e12e06712c0662b2dc01cda824bd795d09de679f42b7ec68c3a6201f2c946dba5018e0ba340bad85e78546a7292f2b864822a89a7d8af38085
-
SSDEEP
6144:Zi05kH9OyU2uv5SRf/FWgFgtBgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:8rHGPv5Smpt6DmUWuVZkxikdXcq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c3624b1dc2d67d7c2d140b9c8a4a0a27f579c6c6093deec1ae6ee0fc7affe55.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\5mcFSL.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{3a9698a7-8b59-5789-8186-33aeee771cee}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{3a9698a7-8b59-5789-8186-33aeee771cee}"2⤵
-
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵
-
C:\Windows\system32\WerFaultSecure.exeC:\Windows\system32\WerFaultSecure.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\zHz.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\6Uy.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Niazd" /SC minute /MO 60 /TR "C:\Windows\system32\4976\WerFaultSecure.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD5ffc18655929d71bd0ade618e46dfa527
SHA19f68e28eeecc6ccd55c1f718b675bb74c13815db
SHA2561a878e94a562396c61c73e1e00313f96842dc6c4918f8236c1255bb72b062894
SHA512efcf2aee800c33eeb6d39fab799d0796aaa0af761bce12d6fd9541eb7e7545b21bc6f84f047ac77820d7d1f24d0eff3cdf33ca5736d6727d009ba989f4301500
-
Filesize
130B
MD595673818c20ee1034e9a4523e38771d9
SHA1c278c57a995a8e65b9a94653885e853a903b5438
SHA25659d5914b3e906ad661b4cea62252297be80ce20b281cf804f8a4968774a57f23
SHA512228604ddcd4ef1c321b01cf53effe6933e8d5b74828830fb7f71120b08d753484b72ad210448c46855597a35b5fa4cc6c5aec5c26d9eea749ce3d977c8c3a691
-
Filesize
728KB
MD5945cfac2e77317b0924447a1b1e75bef
SHA1d281f9f87e4b3a1356fa129b9aa8c61cccf52f09
SHA256094c27836edf1521aa5e6d642b88b5b66d7c507a1ae32794491d1a3d71da8e07
SHA5123d3dae6a26aac0f346ebef7f18e3e55fa93aee4878bd3bbb03a6478e84554994a60279e3f0adbb6c213c65847df8972a2688658484745bda72a33358e704cde4
-
Filesize
732KB
MD5fa4a19fc9642997cdda43328b862d217
SHA1c8be840c5f74a1051993d8228a3e1db42f5445dc
SHA2564e2830e31faf49e33cc94c0154aa9945825e9fd09de5240665d48a3f2ad2813a
SHA512e1b14ce08782b1861c3149a2fcf234c33093c0e2cb1d589bb8b1886e291d07b72e2a2fb9c9e4545e2442dc64a4da9fdbb85106b5d148884ffc72a3e60738b521
-
Filesize
197B
MD5674e4e1e5e4670bd54b1e7584b8023b6
SHA138aa0f95c16c2f9c08b9a405ca8ba16ee2057bb7
SHA2563fad3ef059dfe32c655aefb0c29783d7463b2ce21711023ba5fbbc9f1503f08e
SHA5122e99917c0f7eb510ec6a9fc8f37ec415e437f6778dbfa54db5ae02876e8bd4d96a34564122d68a46704196e8537cc3f65b4b783a7594b10e9b404fde72897282
-
Filesize
76KB
MD5d58a8a987a8dafad9dc32a548cc061e7
SHA1f79fc9e0ab066cad530b949c2153c532a5223156
SHA256cf58e424b86775e6f2354291052126a646f842fff811b730714dfbbd8ebc71a4
SHA51293df28b65af23a5f82124ba644e821614e2e2074c98dbb2bd7319d1dfe9e2179b9d660d7720913c79a8e7b2f8560440789ad5e170b9d94670589885060c14265
-
Filesize
968B
MD5675e64c306a030861493cef030647852
SHA159c2a245445a7103d00c46307473f415eb4db294
SHA256de545b01a7d8ed901d6a95d96918f69ab957903bb230cf434d3fbf618e98d760
SHA512f32b440ed229c2941a3e57a3746b3997a6f758c422a9ac9dc010567fe97d54fe4e359e2b62a87e6eb751ea7d610359633166156b4b14507611f86c1345501478
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
64KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
4KB