6210798e6ca0e95300f15c7c12320f40906e2d27a76bc5f566d2023e4d96c3de

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6210798e6ca0e95300f15c7c12320f40906e2d27a76bc5f566d2023e4d96c3de.dll
Size

1.1MB
MD5

272c86de56ce13b606e24559924cd686
SHA1

74adcabba5d9e796bbd76cf5d986a75f644ce8fc
SHA256

6210798e6ca0e95300f15c7c12320f40906e2d27a76bc5f566d2023e4d96c3de
SHA512

5a75586c7a22ac1ea249615c9305c90128777ff08e9b2a626da253d946763558ca203a69ed89bb2f69ad50a1aef7206a878f0685d92063213a32348994ad548c
SSDEEP

6144:Mi05kH9OyU2uv5SRf/FWgFgtdgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukTV:nrHGPv5SmpteDmUWuVZkxikdXcqNr

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1172	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mwyjnbrrs = "\"C:\\Users\\Admin\\AppData\\Roaming\\bhCv\\DeviceDisplayObjectProvider.exe\""	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\8637\javaws.exe	cmd.exe
File opened for modification	C:\Windows\system32\8637\javaws.exe	cmd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1864	schtasks.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell\open	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell\open\command\ = "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Admin\\AppData\\Local\\Temp\\IQ7tXf6.cmd"	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell\open	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell\open\command	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2748	rundll32.exe
2748	rundll32.exe
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found
1172	Process not Found

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2520	1172	Process not Found	28
PID 1172 wrote to memory of 2520	1172	Process not Found	28
PID 1172 wrote to memory of 2520	1172	Process not Found	28
PID 1172 wrote to memory of 2476	1172	Process not Found	29
PID 1172 wrote to memory of 2476	1172	Process not Found	29
PID 1172 wrote to memory of 2476	1172	Process not Found	29
PID 1172 wrote to memory of 112	1172	Process not Found	31
PID 1172 wrote to memory of 112	1172	Process not Found	31
PID 1172 wrote to memory of 112	1172	Process not Found	31
PID 112 wrote to memory of 2760	112	cmd.exe	33
PID 112 wrote to memory of 2760	112	cmd.exe	33
PID 112 wrote to memory of 2760	112	cmd.exe	33
PID 1172 wrote to memory of 2780	1172	Process not Found	34
PID 1172 wrote to memory of 2780	1172	Process not Found	34
PID 1172 wrote to memory of 2780	1172	Process not Found	34
PID 1172 wrote to memory of 2832	1172	Process not Found	35
PID 1172 wrote to memory of 2832	1172	Process not Found	35
PID 1172 wrote to memory of 2832	1172	Process not Found	35
PID 1172 wrote to memory of 2764	1172	Process not Found	36
PID 1172 wrote to memory of 2764	1172	Process not Found	36
PID 1172 wrote to memory of 2764	1172	Process not Found	36
PID 1172 wrote to memory of 2816	1172	Process not Found	37
PID 1172 wrote to memory of 2816	1172	Process not Found	37
PID 1172 wrote to memory of 2816	1172	Process not Found	37
PID 1172 wrote to memory of 2804	1172	Process not Found	38
PID 1172 wrote to memory of 2804	1172	Process not Found	38
PID 1172 wrote to memory of 2804	1172	Process not Found	38
PID 1172 wrote to memory of 2828	1172	Process not Found	39
PID 1172 wrote to memory of 2828	1172	Process not Found	39
PID 1172 wrote to memory of 2828	1172	Process not Found	39
PID 1172 wrote to memory of 2916	1172	Process not Found	40
PID 1172 wrote to memory of 2916	1172	Process not Found	40
PID 1172 wrote to memory of 2916	1172	Process not Found	40
PID 1172 wrote to memory of 1756	1172	Process not Found	41
PID 1172 wrote to memory of 1756	1172	Process not Found	41
PID 1172 wrote to memory of 1756	1172	Process not Found	41
PID 1172 wrote to memory of 2928	1172	Process not Found	42
PID 1172 wrote to memory of 2928	1172	Process not Found	42
PID 1172 wrote to memory of 2928	1172	Process not Found	42
PID 1172 wrote to memory of 1472	1172	Process not Found	43
PID 1172 wrote to memory of 1472	1172	Process not Found	43
PID 1172 wrote to memory of 1472	1172	Process not Found	43
PID 1172 wrote to memory of 1560	1172	Process not Found	45
PID 1172 wrote to memory of 1560	1172	Process not Found	45
PID 1172 wrote to memory of 1560	1172	Process not Found	45
PID 1560 wrote to memory of 340	1560	eventvwr.exe	46
PID 1560 wrote to memory of 340	1560	eventvwr.exe	46
PID 1560 wrote to memory of 340	1560	eventvwr.exe	46
PID 340 wrote to memory of 1864	340	cmd.exe	48
PID 340 wrote to memory of 1864	340	cmd.exe	48
PID 340 wrote to memory of 1864	340	cmd.exe	48

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6210798e6ca0e95300f15c7c12320f40906e2d27a76bc5f566d2023e4d96c3de.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748

C:\Windows\system32\DeviceDisplayObjectProvider.exe
C:\Windows\system32\DeviceDisplayObjectProvider.exe
1⤵
PID:2520

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\RUx.cmd
1⤵
PID:2476

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{62baf7d1-2421-76c3-d64f-48bbd6001acb}"
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{62baf7d1-2421-76c3-d64f-48bbd6001acb}"
  2⤵
  PID:2760

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe
1⤵
PID:2780

C:\Windows\system32\PkgMgr.exe
C:\Windows\system32\PkgMgr.exe
1⤵
PID:2832

C:\Windows\system32\AtBroker.exe
C:\Windows\system32\AtBroker.exe
1⤵
PID:2764

C:\Windows\system32\wx6deg.exe
C:\Windows\system32\wx6deg.exe
1⤵
PID:2816

C:\Windows\system32\DFDWiz.exe
C:\Windows\system32\DFDWiz.exe
1⤵
PID:2804

C:\Windows\system32\LogonUI.exe
C:\Windows\system32\LogonUI.exe
1⤵
PID:2828

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
1⤵
PID:2916

C:\Windows\system32\AtBroker.exe
C:\Windows\system32\AtBroker.exe
1⤵
PID:1756

C:\Windows\system32\javaws.exe
C:\Windows\system32\javaws.exe
1⤵
PID:2928

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\x50sw.cmd
1⤵
- Drops file in System32 directory
PID:1472

C:\Windows\System32\eventvwr.exe
"C:\Windows\System32\eventvwr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\IQ7tXf6.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Create /F /TN "Bygyxkyzdvxj" /SC minute /MO 60 /TR "C:\Windows\system32\8637\javaws.exe" /RL highest
    3⤵
    - Creates scheduled task(s)
    PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Gp313F.tmp

Filesize
1.1MB

MD5
0e8b7979c52dbda503e59070ce040eea

SHA1
c51ec9e78ddbe45054ef8599727002937009f173

SHA256
49c6f7ec8826e23264488630424fe5d9bc7f93973c3f4b720f23d3ec157c4df9

SHA512
89df9997a8c2b8d161ee765c1c50c46e29d21de9cff599f5d2c14e9639f0ab2f465b3291f3567ab56da3143f63b0a1532134d201e6cff8e434820929f49b930f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IQ7tXf6.cmd

Filesize
129B

MD5
ce0e7d5c79fc7d25ea70741d8bfe2782

SHA1
9461f5ac483a1587ac55ce16062e3dc9fd296cba

SHA256
bac0c0325a9001820b9ae40959ebf4cc39d8dec273dd0ebfa6f8e79c67583be4

SHA512
84b7a23c9943a6838fca579b8f0b874447fd41e1050baa6d47f97fd2d0ac34a53dc131de4dda1c851ac132c9792a2e9906a8f23591417e3a379f8f270ff2718b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RUx.cmd

Filesize
247B

MD5
60f4eac1d5caf7d7b20b7eb5e2140022

SHA1
4dfd640208a573349fbebc33661c79c7f80b7720

SHA256
4a363b24b63b9b3c6f4e6f2d3e8cda799d7dabbe36152011e3d225570feb94e2

SHA512
ee98f5c8095c532e16d380531a6a4985ba76a1c5e8c99a502e8b663533f2a97e625cd892f174bf6756f7367d4fd3bdcba98defdc0801ee227bc70458b248eb01

Download Submit
C:\Users\Admin\AppData\Local\Temp\sKs2FB8.tmp

Filesize
1.1MB

MD5
6c5615d1690cc8b0c1b266958609f189

SHA1
becfc2b2a59f2a9765bd4348ddbad406f551de31

SHA256
8b176853eb73b0993143e8e22ae003dc9a9033106738c78fd6386547e03ec773

SHA512
9c8f09fce85e9abfa690daf245524ce9778e22185abe8731ead9f0454b035d43c446479b0119e3c9db2906e0dbcba1bcd917dd2b3cb2bc9b9992f8ea948a6937

Download Submit
C:\Users\Admin\AppData\Local\Temp\x50sw.cmd

Filesize
192B

MD5
5e0feab5016f212aa20f2095351d9ae2

SHA1
8bbc1e25fa18578f5bdc03c7d7b5249554d9fee8

SHA256
1f5c0561f4226834a491a3712168406006e124182b3f0693e2dffd0800c4b1f9

SHA512
a300c97c8262a9b4f9f82408e0cccbfeb6b57f86a2b4faed151c21a804b18c01ba860fd52ebb021988ff363b9efbddb1d5db9f1c19e171d8a54cdd27b073f37c

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Mwyjnbrrs.lnk

Filesize
970B

MD5
a3a3726cba913b0727d38ddc39f8e83e

SHA1
b70f9fa9b51e4556c1088385166672d8350b7d26

SHA256
c79d52a044ffc5ddd67b85cb54e7cfc04aa4d5a4f910f9167b4916a10ace49ad

SHA512
ff4fe77f0e18082adc86803b24b431ce6ff29eed28fd37bbf383cadb6c880b347324bb661e24b037d9fa304a4ffc3c4ab51360a4132c747d55a9456cf8b1fce9

Download Submit
C:\Users\Admin\AppData\Roaming\bhCv\DeviceDisplayObjectProvider.exe

Filesize
109KB

MD5
7e2eb3a4ae11190ef4c8a9b9a9123234

SHA1
72e98687a8d28614e2131c300403c2822856e865

SHA256
8481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0

SHA512
18b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf

Download Submit
memory/1172-35-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-24-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-11-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-22-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-12-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-13-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-14-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-15-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-16-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-17-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-20-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-29-0x0000000002DC0000-0x0000000002DC7000-memory.dmp

Filesize
28KB

Download
memory/1172-36-0x0000000076E61000-0x0000000076E62000-memory.dmp

Filesize
4KB

Download
memory/1172-99-0x0000000076C56000-0x0000000076C57000-memory.dmp

Filesize
4KB

Download
memory/1172-27-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-26-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-25-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-10-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-23-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-21-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-19-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-18-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-45-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-47-0x0000000076FC0000-0x0000000076FC2000-memory.dmp

Filesize
8KB

Download
memory/1172-50-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-53-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-9-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-8-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-7-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/1172-3-0x0000000076C56000-0x0000000076C57000-memory.dmp

Filesize
4KB

Download
memory/1172-4-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Filesize
4KB

Download
memory/2748-6-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/2748-0-0x0000000140000000-0x000000014010E000-memory.dmp

Filesize
1.1MB

Download
memory/2748-2-0x00000000002F0000-0x00000000002F7000-memory.dmp

Filesize
28KB

Download