Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03-06-2024 20:41
General
-
Target
3f64dfb29d43348177eac67aeb66fe07fc5901e57f3592dd5756cced05df0d39.dll
-
Size
1.1MB
-
MD5
bec40fa6cb88552a0bb7ba09397f5f3c
-
SHA1
c34a4420a580a94ba3842e3633454be4eced3103
-
SHA256
3f64dfb29d43348177eac67aeb66fe07fc5901e57f3592dd5756cced05df0d39
-
SHA512
c5f49d8349f12905e38d9c712bca5d432df9166cc31b3475cf3525c6401430185f4065bf80e22085cb171f1c04261d205c0f08a979e690c06b0740075c13b741
-
SSDEEP
6144:pi05kH9OyU2uv5SRf/FWgFgtBgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:MrHGPv5Smpt6DmUWuVZkxikdXcq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3f64dfb29d43348177eac67aeb66fe07fc5901e57f3592dd5756cced05df0d39.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dusmtask.exeC:\Windows\system32\dusmtask.exe1⤵
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\Ruo.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6fbc9e50-6a1b-17d9-5db5-133f618c672e}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6fbc9e50-6a1b-17d9-5db5-133f618c672e}"2⤵
-
-
C:\Windows\system32\wuapihost.exeC:\Windows\system32\wuapihost.exe1⤵
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\TZs.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\4GXaBeR.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Lgeeulo" /SC minute /MO 60 /TR "C:\Windows\system32\0146\ie4uinit.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4276,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126B
MD513952454cdeb7bad5e5420ba4b114b3e
SHA133db926887083d736cbee4cdfa5495dc28b64f2c
SHA256d8a53c048c73e0d9612eb3dd1d6fb7847101e785c8018149dc2108641e2d9dde
SHA512aa17ac216364e58572bb163739815db21289af5ba362832b1f148346656f438ef97d153c584d035b4aaae8f1385ebf188e8c7973dc884b3a09f13776c71a3aa2
-
Filesize
1.1MB
MD52ac85820a731a74dc44d7aab0ddbe7e8
SHA180623a7ff18c2148a5b9ad2d27c9fcbc1562ee07
SHA256a54cbb09caf17f1d83287e81443de4f273f7eea5ab64e8b120f8c7201978c643
SHA51234e7784a9d49fdeccb1389f4683a4aa62cee117922e94918d0560b70af3862fcead0b85af754398efd7f16febd2517a9bdff4490f7074af119c511505e6d7585
-
Filesize
235B
MD5d23a71386161f68b1914973c04253be6
SHA17ebac62a977bdf6974c4e43e32974ff14bbfea46
SHA256cd1914b7afe24470ac1903feb1141c91e7c9b1313bf2331a652fe676735caf24
SHA512397cb0decc4a1bfde371c81144177718d71154545ac8745e022194c56a08305879710c942167db9321a2930eb35bf40369c9a1e0ed97a642c409718c66c6cbbc
-
Filesize
193B
MD58cb8592a3acc1408826c68d6464da56c
SHA11a709de756b2d633302554fbaf7634bdae2ec598
SHA256c1622db5d15fef49be314afb71eb02108e859d787a270e71ec09118dc060198a
SHA512c07dd4791e87e68f49e3e74bcda61f1e273101b2147697266105e86f839044bc19e00c71e28e068d977da8f074c13bc50af751a439a77a591863b078b2b521b5
-
Filesize
1.1MB
MD5b0777132ba7bd9dc59b465bff83bdbd7
SHA1b3cf60c6b98cecb2b8268d0689e534e8855c38cb
SHA2564f1eec9b00580bbbdb8ce76c4293ba2b5c69fcb3256781ad2d8195f09e3ce38f
SHA512ff76df6fd4028e24e9a22b8e8356174b2b79ab1be7790f2af8e5d6ea84a50456c1364481af516922636987f479c9b0f59b51d5ea6148b14b3da53b64886a528b
-
Filesize
928B
MD5b1567b02ba335011a1a763907124d144
SHA1c16526f7ca1f8ece19a4734815342ce439b8895c
SHA2565c4d68f59d77088ae940b2d4cc65d5e618fddb1468ae93c2244013fe43374f99
SHA512f12694f34991cfec94d623106fd55543ed49e1c6723a5283ff378e106d9ec7c4b23a59fc0d4978aa0b99f0ed36eb14123d701b52db017d42585ac01cab9851f3
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB