Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
03/06/2024, 05:01
General
-
Target
e85b862f940e6ee522b74384346a4cf196b6827ab5a81d8f0f6170b9b0c0e5c6.dll
-
Size
736KB
-
MD5
b8e030600df3d279215a9d943166ed68
-
SHA1
306c0e5c29dcdc60f884827919bddfae85a23443
-
SHA256
e85b862f940e6ee522b74384346a4cf196b6827ab5a81d8f0f6170b9b0c0e5c6
-
SHA512
05c6c1c2bb266fc455417e59d56dd0c7a7da3685bae84f6832c112da7d076f33f461bbaa59b97f7ea51653e157dfacf9da4d088d55049c33041fb5b31b0200c6
-
SSDEEP
6144:Oi05kH9OyU2uv5SRf/FWgFgtegqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:hrHGPv5SmptjDmUWuVZkxikdXcq
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e85b862f940e6ee522b74384346a4cf196b6827ab5a81d8f0f6170b9b0c0e5c6.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\fvenotify.exeC:\Windows\system32\fvenotify.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\guEkh.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{33819f3b-2f8d-cfcb-0a23-a942879f9636}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{33819f3b-2f8d-cfcb-0a23-a942879f9636}"2⤵
-
-
C:\Windows\system32\wsmprovhost.exeC:\Windows\system32\wsmprovhost.exe1⤵
-
C:\Windows\system32\rrinstaller.exeC:\Windows\system32\rrinstaller.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\0wm5.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\wgHRy.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Vmvmshnity" /SC minute /MO 60 /TR "C:\Windows\system32\8738\rrinstaller.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
195B
MD5ef3667197d4e80be697539354adaf1ff
SHA18dc6c80ba17c7c8909a3d6baaeebedf4cd55f294
SHA256cb744609de598f7c3e2e6f9a81beaefaa201ec75106d6b15f594cb1c5120c7cd
SHA512f3bb27261bedcf5681de2ecc04664cb5442127f67fea54de98b467273321231b49fced25d93ec21e113badba0c151448f18d89aa0d529e6682e67cecd605bff8
-
Filesize
740KB
MD5bc4c8639649b285019cf19ab1399272d
SHA14efedc272fa0f155273adc1a85732a34f2674076
SHA256955472f659e6e1ec06770af5d55eea1d2a2900039a83ce72d84096bff604273c
SHA5127798ce693ea6b66e62df4cdb82f9a40f70782791e5b409aa6acf3d168ade0e786fb2f88796fa8f81e67a87c279a6ba096ab29da4d92dea2563324187329cf71b
-
Filesize
229B
MD5fe17e08b540ed7f3cc796b040b4711d5
SHA1932ab86143109ea5e37083c7e95cb5318f005ae9
SHA256b8f7d7e7d3e4284a00167a0c7134aa63dd4a4c10e4fd73ed5f38cff22c9e6e2c
SHA51245064989807613a3f45b45c3835ab5cadf020ac1c128bc6f83e5569c83f4b8d5531676c1416c74e96bc432130c088ea5daeebec636aa7ddae230b6b8b7227b49
-
Filesize
744KB
MD5ef0058399c6ce1317e66febf1d8d3e14
SHA1e174dd25b56b2ed7aa44e68c676399a670846642
SHA256cc3539934ce5a96e72e2597c2bb2351a335e2aae27c87e3e1011aaace243297c
SHA5122adb411c02927389d47cd9cbd97796d4cf67009d32351afe3b09f10ba1a95cd80f7328128acf91a5c2596f916f65ca36b64ada8ba77b41c9daf60490c9cee641
-
Filesize
132B
MD510e79f6cb7b1d022c86ce439df31af12
SHA1d38fa2093adc3c84e1c5e6d0cc37e6d0fea8027a
SHA256e651a6ad31abbedeaa020d839448dc1a564fdf210fb81e2f553ecb03085d442e
SHA512aaf8ba291532d6683457c8f3ec5ed8063389beec99cfbe80423d5536cc47c23f24c652236962ac6ff24407bc50a1ba89a16c4ea98b5ad750d5091f0823db344c
-
Filesize
117KB
MD5e61d644998e07c02f0999388808ac109
SHA1183130ad81ff4c7997582a484e759bf7769592d6
SHA25615a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa
SHA512310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272
-
Filesize
890B
MD54742e5baad13e89b2636cd70ae97b6d4
SHA1c6e7b3d773a9adcac0206731937ef02ed6d3f3a7
SHA256221e4f85a73d79ff60177f93cef3a5fbb776a9c6deee840a66efd6794c2037f6
SHA5128fa7f56905e581dbf1aa00eaad041468638a63c1d555966c98ec612d64c4ad58f8a31af4050403bf0e30f3a2916367da35ecdf6d9db16be5be665d24ff2c48f3
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
28KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
4KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
4KB
-
Filesize
736KB
-
Filesize
8KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
736KB
-
Filesize
28KB
-
Filesize
736KB