Analysis
- max time kernel
149s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
02/06/2024, 02:47
General
- Target cb81e93c2f9004001521c18b97562427871a7bf8c2f8ab23756852e5d5f9859a.dll
- Size 500KB
- Sample240602-c9ys2agc7v
- SHA256 cb81e93c2f9004001521c18b97562427871a7bf8c2f8ab23756852e5d5f9859a
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in System32 directory 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 11 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cb81e93c2f9004001521c18b97562427871a7bf8c2f8ab23756852e5d5f9859a.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rrinstaller.exeC:\Windows\system32\rrinstaller.exe1⤵
-
C:\Windows\system32\UIMgrBroker.exeC:\Windows\system32\UIMgrBroker.exe1⤵
-
C:\Windows\system32\WallpaperHost.exeC:\Windows\system32\WallpaperHost.exe1⤵
-
C:\Windows\system32\RemotePosWorker.exeC:\Windows\system32\RemotePosWorker.exe1⤵
-
C:\Windows\system32\taskhostw.exeC:\Windows\system32\taskhostw.exe1⤵
-
C:\Windows\system32\rasphone.exeC:\Windows\system32\rasphone.exe1⤵
-
C:\Windows\system32\DeviceCensus.exeC:\Windows\system32\DeviceCensus.exe1⤵
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\MNk.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{3a9698a7-8b59-5789-8186-33aeee771cee}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{3a9698a7-8b59-5789-8186-33aeee771cee}"2⤵
-
-
C:\Windows\system32\cmdl32.exeC:\Windows\system32\cmdl32.exe1⤵
-
C:\Windows\system32\DsmUserTask.exeC:\Windows\system32\DsmUserTask.exe1⤵
-
C:\Windows\system32\PkgMgr.exeC:\Windows\system32\PkgMgr.exe1⤵
-
C:\Windows\system32\AppVShNotify.exeC:\Windows\system32\AppVShNotify.exe1⤵
-
C:\Windows\system32\RemotePosWorker.exeC:\Windows\system32\RemotePosWorker.exe1⤵
-
C:\Windows\system32\LsaIso.exeC:\Windows\system32\LsaIso.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\Ep0.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\PVI1l.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Niazd" /SC minute /MO 60 /TR "C:\Windows\system32\5247\LsaIso.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Ep0.cmd
F04C8A.tmp
MNk.cmd
PVI1l.cmd
tBR4D75.tmp
Iphtcfjrejti.lnk
Netplwiz.exe
memory/528-1-0x0000000140000000-0x000000014007D000-memory.dmp
memory/528-6-0x0000000140000000-0x000000014007D000-memory.dmp
memory/528-2-0x00000252DC860000-0x00000252DC867000-memory.dmp
memory/3564-20-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-14-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-41-0x00007FFE75C20000-0x00007FFE75C30000-memory.dmp
memory/3564-40-0x0000000002C80000-0x0000000002C87000-memory.dmp
memory/3564-38-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-21-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-29-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-19-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-18-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-17-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-16-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-50-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-12-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-11-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-10-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-9-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-8-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-22-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-7-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-15-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-13-0x0000000140000000-0x000000014007D000-memory.dmp
memory/3564-5-0x00007FFE73CDA000-0x00007FFE73CDB000-memory.dmp
memory/3564-3-0x0000000007710000-0x0000000007711000-memory.dmp