235af3de0ac763c04428d827b5ee59e3f733951050137af6d6b6bba90d338c80

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

235af3de0ac763c04428d827b5ee59e3f733951050137af6d6b6bba90d338c80.dll
Size

568KB
MD5

3d366c8734bf744294f50fe9aac17b1b
SHA1

e3765ed57be72a40a29d881ace7aaa18a0211b16
SHA256

235af3de0ac763c04428d827b5ee59e3f733951050137af6d6b6bba90d338c80
SHA512

81903034b3e88613d26807122d52f6a7614ae475ed5310a47d4fc23319adc9311dbd3b649d23b168e35e28f4d7277896beac6b53f8d7337490cb02ae77538b94
SSDEEP

6144:ei05kH9OyU2uv5SRf/FWgFgtBgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:xrHGPv5Smpt6DmUWuVZkxikdXcq

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1208	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tonqjizj = "\"C:\\Users\\Admin\\AppData\\Roaming\\n3HT1A\\SystemPropertiesHardware.exe\""	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\9420\mblctr.exe	cmd.exe
File opened for modification	C:\Windows\system32\9420\mblctr.exe	cmd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2008	schtasks.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\MSCFile	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\MSCFile	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\MSCFile\shell	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\MSCFile\shell\open\command\ = "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Admin\\AppData\\Local\\Temp\\ajoFVk.cmd"	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\MSCFile\shell\open	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\MSCFile\shell\open	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\MSCFile\shell	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2892	rundll32.exe
2892	rundll32.exe
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 2412	1208	Process not Found	28
PID 1208 wrote to memory of 2412	1208	Process not Found	28
PID 1208 wrote to memory of 2412	1208	Process not Found	28
PID 1208 wrote to memory of 2564	1208	Process not Found	29
PID 1208 wrote to memory of 2564	1208	Process not Found	29
PID 1208 wrote to memory of 2564	1208	Process not Found	29
PID 1208 wrote to memory of 2352	1208	Process not Found	31
PID 1208 wrote to memory of 2352	1208	Process not Found	31
PID 1208 wrote to memory of 2352	1208	Process not Found	31
PID 2352 wrote to memory of 2200	2352	cmd.exe	33
PID 2352 wrote to memory of 2200	2352	cmd.exe	33
PID 2352 wrote to memory of 2200	2352	cmd.exe	33
PID 1208 wrote to memory of 1200	1208	Process not Found	34
PID 1208 wrote to memory of 1200	1208	Process not Found	34
PID 1208 wrote to memory of 1200	1208	Process not Found	34
PID 1208 wrote to memory of 1648	1208	Process not Found	35
PID 1208 wrote to memory of 1648	1208	Process not Found	35
PID 1208 wrote to memory of 1648	1208	Process not Found	35
PID 1208 wrote to memory of 2764	1208	Process not Found	36
PID 1208 wrote to memory of 2764	1208	Process not Found	36
PID 1208 wrote to memory of 2764	1208	Process not Found	36
PID 1208 wrote to memory of 2708	1208	Process not Found	37
PID 1208 wrote to memory of 2708	1208	Process not Found	37
PID 1208 wrote to memory of 2708	1208	Process not Found	37
PID 1208 wrote to memory of 2752	1208	Process not Found	38
PID 1208 wrote to memory of 2752	1208	Process not Found	38
PID 1208 wrote to memory of 2752	1208	Process not Found	38
PID 1208 wrote to memory of 2960	1208	Process not Found	40
PID 1208 wrote to memory of 2960	1208	Process not Found	40
PID 1208 wrote to memory of 2960	1208	Process not Found	40
PID 2960 wrote to memory of 2336	2960	eventvwr.exe	41
PID 2960 wrote to memory of 2336	2960	eventvwr.exe	41
PID 2960 wrote to memory of 2336	2960	eventvwr.exe	41
PID 2336 wrote to memory of 2008	2336	cmd.exe	43
PID 2336 wrote to memory of 2008	2336	cmd.exe	43
PID 2336 wrote to memory of 2008	2336	cmd.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\235af3de0ac763c04428d827b5ee59e3f733951050137af6d6b6bba90d338c80.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2892

C:\Windows\system32\SystemPropertiesHardware.exe
C:\Windows\system32\SystemPropertiesHardware.exe
1⤵
PID:2412

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\ApT.cmd
1⤵
PID:2564

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{33819f3b-2f8d-cfcb-0a23-a942879f9636}"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{33819f3b-2f8d-cfcb-0a23-a942879f9636}"
  2⤵
  PID:2200

C:\Windows\system32\Eap3Host.exe
C:\Windows\system32\Eap3Host.exe
1⤵
PID:1200

C:\Windows\system32\cleanmgr.exe
C:\Windows\system32\cleanmgr.exe
1⤵
PID:1648

C:\Windows\system32\dinotify.exe
C:\Windows\system32\dinotify.exe
1⤵
PID:2764

C:\Windows\system32\mblctr.exe
C:\Windows\system32\mblctr.exe
1⤵
PID:2708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\gUmd.cmd
1⤵
- Drops file in System32 directory
PID:2752

C:\Windows\System32\eventvwr.exe
"C:\Windows\System32\eventvwr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\ajoFVk.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Create /F /TN "Vmvmshnity" /SC minute /MO 60 /TR "C:\Windows\system32\9420\mblctr.exe" /RL highest
    3⤵
    - Creates scheduled task(s)
    PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ApT.cmd

Filesize
246B

MD5
1a86633896574e3958f8e3915a7eafa5

SHA1
a8adea8aa8d1485141463518637637f7179e1f52

SHA256
d7f5dfaaf0bff0288436a368f9470201e8510230a36ea5217300af49a84d65d1

SHA512
6c6966a981725c8328aea5fea8213de55d05b2b783d5e19d7f3925d156514cfcd18fb6e4f0c32472e3cd113ad5a28f65ca9ed1869c9b0d627d18fc1b3ed99269

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZCJ3BD9.tmp

Filesize
572KB

MD5
cd1b6dc75a07f13c5ae9dfd70252f457

SHA1
f580a983d99c64169e9193e6b357fa55056cb41b

SHA256
7853d6041db3aaf540fe03eee3b947805283ddfd8229345109aca9ac761750d3

SHA512
9650e9aea6ba6c39fdc9c4f52680755192ab212bbc3a67f2de79b5f9b95b030f0961dc0c6f3b34378a52b15bbc5328424a7edb766fc90262e076c201f002d015

Download Submit
C:\Users\Admin\AppData\Local\Temp\ajoFVk.cmd

Filesize
127B

MD5
7f0aafe4727c9906f2190cbcfef9ac1f

SHA1
1d179a585e97e038a5c3d6d143ee62a4a7f2d852

SHA256
3172ba7aa9ea51ec397809714ee2712c2421138f286c83d0204bc7e959714739

SHA512
e8d62ba260a663b70dd415d92b80e75850b6b566b46994f67f2b600a96404c5e3eece4fbaa2eb6fceb6cb795102ef1d8955b2d1e453846df255adc1fe33de7be

Download Submit
C:\Users\Admin\AppData\Local\Temp\gUmd.cmd

Filesize
189B

MD5
f78f42b6ccee105c3d2cd40f890be476

SHA1
699ea35440f1ea0b59a36624cb6c1e5a4ca9bb60

SHA256
0546ef899a0bd82fb615c7b4d99f2ecd278a9d8172b95eda371b669cd1dbc4ae

SHA512
13edfca0ecb455f31f3ca03f3c20aeb27b6c9aaff20fc8526ce9fa67ed7e52b8836d9709104fb9f517b8c2e419bbb2b4cc53a70bf6b2c594d8ceae471bc2453c

Download Submit
C:\Users\Admin\AppData\Local\Temp\o3B0D.tmp

Filesize
572KB

MD5
8ef5cd6fa68231a966d8ac87c27519c5

SHA1
813bb9d6fd9fbbbcce4ed06310f1b2d26d31a8c5

SHA256
026a1456a73232263a4abd028c7d8aef21117551ed1006cbd0c9faabde39ddbe

SHA512
397d3c227444a2cd58706375835a847a23616bb15c64cc5f25542e018c9b0f25e5dd3797a607ea2531ab20653196a89517696da6faf27c440825effcc8921df1

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Tonqjizj.lnk

Filesize
966B

MD5
f010b4c892fa05c19220297eff279fbd

SHA1
746c7791210d1e9bded31624bd803d0c3c454b98

SHA256
b29aa4d17d38fe312f7fa81ddca953b20c31da7df8dfae428edd4ba6a17e8c7c

SHA512
47605911a84a199436889c69ff570bcffe221be27b9ddb5f165989dd8a3582130d9fca4419e48491a664a48f445849d143809c5ad341c604a3877fb1a36a2bc9

Download Submit
C:\Users\Admin\AppData\Roaming\n3HT1A\SystemPropertiesHardware.exe

Filesize
80KB

MD5
c63d722641c417764247f683f9fb43be

SHA1
948ec61ebf241c4d80efca3efdfc33fe746e3b98

SHA256
4759296b421d60c80db0bb112a30425e04883900374602e13ed97f7c03a49df2

SHA512
7223d1c81a4785ed790ec2303d5d9d7ebcae9404d7bf173b3145e51202564de9977e94ac10ab80c6fe49b5f697af3ec70dfd922a891915e8951b5a1b5841c8be

Download Submit
memory/1208-16-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-12-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-28-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-27-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-25-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-24-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-23-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-22-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-21-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-20-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-19-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-18-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-17-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-103-0x0000000077246000-0x0000000077247000-memory.dmp

Filesize
4KB

Download
memory/1208-15-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-14-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-13-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-30-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-11-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-38-0x0000000002AB0000-0x0000000002AB7000-memory.dmp

Filesize
28KB

Download
memory/1208-10-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-8-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-29-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-26-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-39-0x0000000077451000-0x0000000077452000-memory.dmp

Filesize
4KB

Download
memory/1208-48-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-49-0x00000000775B0000-0x00000000775B2000-memory.dmp

Filesize
8KB

Download
memory/1208-56-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-37-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-9-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-7-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/1208-3-0x0000000077246000-0x0000000077247000-memory.dmp

Filesize
4KB

Download
memory/1208-4-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/2892-6-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download
memory/2892-2-0x00000000002F0000-0x00000000002F7000-memory.dmp

Filesize
28KB

Download
memory/2892-0-0x0000000140000000-0x000000014008E000-memory.dmp

Filesize
568KB

Download