Analysis
- max time kernel
149s - max time network
127s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
- submitted
02/06/2024, 22:30
General
- Target 5cc3f4aa61f9ed8c5b78fef21d8cfee13dafc584e2320bb9da58e73da09029d5.dll
- Size 760KB
- Sample240602-2e2c4sae38
- SHA256 5cc3f4aa61f9ed8c5b78fef21d8cfee13dafc584e2320bb9da58e73da09029d5
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 9 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5cc3f4aa61f9ed8c5b78fef21d8cfee13dafc584e2320bb9da58e73da09029d5.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\7yXTr.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{62baf7d1-2421-76c3-d64f-48bbd6001acb}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{62baf7d1-2421-76c3-d64f-48bbd6001acb}"2⤵
-
-
C:\Windows\system32\logagent.exeC:\Windows\system32\logagent.exe1⤵
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\ZG2R.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\IKOyebX.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Bygyxkyzdvxj" /SC minute /MO 60 /TR "C:\Windows\system32\3087\wbengine.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
7yXTr.cmd
IKOyebX.cmd
S2685.tmp
V5u251D.tmp
ZG2R.cmd
BitLockerWizard.exe
Mwyjnbrrs.lnk
memory/1208-21-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-16-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-10-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-11-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-12-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-13-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-32-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-31-0x0000000002530000-0x0000000002537000-memory.dmp
memory/1208-24-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-23-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-22-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-96-0x0000000077A86000-0x0000000077A87000-memory.dmp
memory/1208-20-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-19-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-17-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-9-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-15-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-14-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-33-0x0000000077B91000-0x0000000077B92000-memory.dmp
memory/1208-42-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-48-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-47-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-46-0x0000000077CF0000-0x0000000077CF2000-memory.dmp
memory/1208-18-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-8-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-7-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1208-3-0x0000000077A86000-0x0000000077A87000-memory.dmp
memory/1208-4-0x0000000002550000-0x0000000002551000-memory.dmp
memory/1340-6-0x0000000140000000-0x00000001400BE000-memory.dmp
memory/1340-2-0x0000000000170000-0x0000000000177000-memory.dmp
memory/1340-0-0x0000000140000000-0x00000001400BE000-memory.dmp