d94704356d193cb7e271da4ff6f1e36722ce4508b0ea9d8768a4c59b43fba131

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d94704356d193cb7e271da4ff6f1e36722ce4508b0ea9d8768a4c59b43fba131.dll
Size

520KB
MD5

4cd048efbfcbfcf4d7c411bdad4afa7f
SHA1

492565cd6833e366dc27971722388152ffecc905
SHA256

d94704356d193cb7e271da4ff6f1e36722ce4508b0ea9d8768a4c59b43fba131
SHA512

5b723fa17f05003fe232b91af4c5ef6b4ee491bde5e115a14d62c42e915360d37e97184dac32ba852cb872131a7cb1081db6e87365f8158b7bb280d165122fec
SSDEEP

6144:Ki05kH9OyU2uv5SRf/FWgFgtBgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:VrHGPv5Smpt6DmUWuVZkxikdXcq

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1196	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mwyjnbrrs = "\"C:\\Users\\Admin\\AppData\\Roaming\\jLi1M\\rdrleakdiag.exe\""	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\5887\fvenotify.exe	cmd.exe
File opened for modification	C:\Windows\system32\5887\fvenotify.exe	cmd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1724	schtasks.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell\open	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell\open\command\ = "C:\\Windows\\system32\\cmd.exe /c C:\\Users\\Admin\\AppData\\Local\\Temp\\CkETgx.cmd"	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell\open\command	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\MSCFile\shell\open	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2028	regsvr32.exe
2028	regsvr32.exe
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2708	1196	Process not Found	28
PID 1196 wrote to memory of 2708	1196	Process not Found	28
PID 1196 wrote to memory of 2708	1196	Process not Found	28
PID 1196 wrote to memory of 2552	1196	Process not Found	29
PID 1196 wrote to memory of 2552	1196	Process not Found	29
PID 1196 wrote to memory of 2552	1196	Process not Found	29
PID 1196 wrote to memory of 2996	1196	Process not Found	30
PID 1196 wrote to memory of 2996	1196	Process not Found	30
PID 1196 wrote to memory of 2996	1196	Process not Found	30
PID 1196 wrote to memory of 2664	1196	Process not Found	31
PID 1196 wrote to memory of 2664	1196	Process not Found	31
PID 1196 wrote to memory of 2664	1196	Process not Found	31
PID 1196 wrote to memory of 2700	1196	Process not Found	32
PID 1196 wrote to memory of 2700	1196	Process not Found	32
PID 1196 wrote to memory of 2700	1196	Process not Found	32
PID 1196 wrote to memory of 2696	1196	Process not Found	33
PID 1196 wrote to memory of 2696	1196	Process not Found	33
PID 1196 wrote to memory of 2696	1196	Process not Found	33
PID 1196 wrote to memory of 2752	1196	Process not Found	34
PID 1196 wrote to memory of 2752	1196	Process not Found	34
PID 1196 wrote to memory of 2752	1196	Process not Found	34
PID 1196 wrote to memory of 2964	1196	Process not Found	36
PID 1196 wrote to memory of 2964	1196	Process not Found	36
PID 1196 wrote to memory of 2964	1196	Process not Found	36
PID 2964 wrote to memory of 2984	2964	cmd.exe	38
PID 2964 wrote to memory of 2984	2964	cmd.exe	38
PID 2964 wrote to memory of 2984	2964	cmd.exe	38
PID 1196 wrote to memory of 1836	1196	Process not Found	39
PID 1196 wrote to memory of 1836	1196	Process not Found	39
PID 1196 wrote to memory of 1836	1196	Process not Found	39
PID 1196 wrote to memory of 1960	1196	Process not Found	40
PID 1196 wrote to memory of 1960	1196	Process not Found	40
PID 1196 wrote to memory of 1960	1196	Process not Found	40
PID 1196 wrote to memory of 1136	1196	Process not Found	41
PID 1196 wrote to memory of 1136	1196	Process not Found	41
PID 1196 wrote to memory of 1136	1196	Process not Found	41
PID 1196 wrote to memory of 1420	1196	Process not Found	42
PID 1196 wrote to memory of 1420	1196	Process not Found	42
PID 1196 wrote to memory of 1420	1196	Process not Found	42
PID 1196 wrote to memory of 2516	1196	Process not Found	43
PID 1196 wrote to memory of 2516	1196	Process not Found	43
PID 1196 wrote to memory of 2516	1196	Process not Found	43
PID 1196 wrote to memory of 2816	1196	Process not Found	44
PID 1196 wrote to memory of 2816	1196	Process not Found	44
PID 1196 wrote to memory of 2816	1196	Process not Found	44
PID 1196 wrote to memory of 2956	1196	Process not Found	46
PID 1196 wrote to memory of 2956	1196	Process not Found	46
PID 1196 wrote to memory of 2956	1196	Process not Found	46
PID 2956 wrote to memory of 2332	2956	eventvwr.exe	47
PID 2956 wrote to memory of 2332	2956	eventvwr.exe	47
PID 2956 wrote to memory of 2332	2956	eventvwr.exe	47
PID 2332 wrote to memory of 1724	2332	cmd.exe	49
PID 2332 wrote to memory of 1724	2332	cmd.exe	49
PID 2332 wrote to memory of 1724	2332	cmd.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d94704356d193cb7e271da4ff6f1e36722ce4508b0ea9d8768a4c59b43fba131.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028

C:\Windows\system32\iscsicpl.exe
C:\Windows\system32\iscsicpl.exe
1⤵
PID:2708

C:\Windows\system32\ocsetup.exe
C:\Windows\system32\ocsetup.exe
1⤵
PID:2552

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
1⤵
PID:2996

C:\Windows\system32\LocationNotifications.exe
C:\Windows\system32\LocationNotifications.exe
1⤵
PID:2664

C:\Windows\system32\MultiDigiMon.exe
C:\Windows\system32\MultiDigiMon.exe
1⤵
PID:2700

C:\Windows\system32\rdrleakdiag.exe
C:\Windows\system32\rdrleakdiag.exe
1⤵
PID:2696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\571aYHe.cmd
1⤵
PID:2752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{62baf7d1-2421-76c3-d64f-48bbd6001acb}"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{62baf7d1-2421-76c3-d64f-48bbd6001acb}"
  2⤵
  PID:2984

C:\Windows\system32\WPDShextAutoplay.exe
C:\Windows\system32\WPDShextAutoplay.exe
1⤵
PID:1836

C:\Windows\system32\gpscript.exe
C:\Windows\system32\gpscript.exe
1⤵
PID:1960

C:\Windows\system32\sdchange.exe
C:\Windows\system32\sdchange.exe
1⤵
PID:1136

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
1⤵
PID:1420

C:\Windows\system32\fvenotify.exe
C:\Windows\system32\fvenotify.exe
1⤵
PID:2516

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\LtRV7.cmd
1⤵
- Drops file in System32 directory
PID:2816

C:\Windows\System32\eventvwr.exe
"C:\Windows\System32\eventvwr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\CkETgx.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\schtasks.exe
    schtasks.exe /Create /F /TN "Bygyxkyzdvxj" /SC minute /MO 60 /TR "C:\Windows\system32\5887\fvenotify.exe" /RL highest
    3⤵
    - Creates scheduled task(s)
    PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\571aYHe.cmd

Filesize
228B

MD5
a3e0beadbf6d2992abc2cd3f2691be9d

SHA1
ca93aec9e22a577460b09d5dc9d1e632e82b90fa

SHA256
58c3db63d0a1839e621c653fd4c081abbd9fb8bad6e7fa40753f903ffc882d1e

SHA512
0ef0e758712d14444884bcdaf1c12339d2a2c230cc26ce78b1ca51cdedc5302c3076d81d3e4f25c80f30cd2a7c9b7f71f3117302d3278a1e9cb37fc39bd9007f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CkETgx.cmd

Filesize
132B

MD5
80e8b06d982d13b99252dbcd5af30633

SHA1
a2763bf055454034efa7c1559d19ac5f658cf68b

SHA256
66d4860a0693edb20632b79af431d8318e1559ae94696ffc9e16e55fee255e5d

SHA512
bfa46ddeb3ae080a3eb46081d91d181f0dce0f583b815b91a94a35075be2d60aa123639d3be7f5ce3c0ec17300dfcd5b325d82ad68d8c2bfa0262164b680addf

Download Submit
C:\Users\Admin\AppData\Local\Temp\L1814.tmp

Filesize
524KB

MD5
7798b9c711c03de987b4ea605d61b07d

SHA1
4b1ffb4eca6027f6705cf3937ce7fc5aa7a4530e

SHA256
3d73a0337bddc822351b51b5bbd023d1b4ef505370191d987c4af55239322759

SHA512
f758c07291356a776b76cfb11ae86c690d4d2c64eb1e79b6a9db0fd318934efcd6543c57978106d55b4d47c96ff35b717376c2aaaf0fe81db901a35f1c1d2e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\LtRV7.cmd

Filesize
190B

MD5
c5d399101e0fa8e162c49e521f3b70cd

SHA1
c5bfef06ebee8c4c5b6079c90fe0519237d2e2da

SHA256
2aa0e80b272d4521b503fcb45ce6c8a663497f44eff3acc464d110ed8ae52724

SHA512
d2b899206364dfd5d8668ac84311725ddfc46253bfb9c87ad7c0e167b7d38591ab1079f2f9fbd97122def95980689d6133c7b6153f3902cb85bd9c995f2087f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\d1719.tmp

Filesize
524KB

MD5
1d50ec3a5ae3895b448c80aa4ac36095

SHA1
b512b90b19e7c4c47f838c3e3652445c99f4f237

SHA256
7186a6e1ffb0d003a95dc32d2f825778fbc0641ebcc7b32fdb0a26f5c06b5aba

SHA512
0b3d2b94ab2d9ab1b4851e02780c1d6fdd8948801b8aeb64182e4a986afe571b203f9f3932a35c2d1730438ca1d0d13d47e69c3cbd009da1ec532c8a60eae029

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Mwyjnbrrs.lnk

Filesize
894B

MD5
a1e5f2092c412ce10721416704da7dcd

SHA1
b4b9840309964699ef64515f74077416a982fc05

SHA256
bfc732f8ede0e0907566713975f05f7cf14936f524a963f94df5a4002fb4dac4

SHA512
c2d0127da8e98276206a7d107c1c781fc422e546faa7ed85c9e8bae362390667c485adbc27661e32b1ba6100ba7c7948a3aca21ba2f1055d04dc11649d976729

Download Submit
C:\Users\Admin\AppData\Roaming\jLi1M\rdrleakdiag.exe

Filesize
39KB

MD5
5e058566af53848541fa23fba4bb5b81

SHA1
769ce3bfc45e4d56ed01dbeeeca7be22f9b9eed6

SHA256
ae83b050fa722da7e4b19fc3d534f0126b1ec055643bb1f267b85b55160f4409

SHA512
352029cf0af7583a4c525cfd1da7467446bac410a885b2768d8052f39577ccce85b21d5bd946be6bf8341e7308c8e4f645e4d79232b93aaf6a92d6cd55f598d0

Download Submit
memory/1196-21-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-17-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-14-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-40-0x0000000002D20000-0x0000000002D27000-memory.dmp

Filesize
28KB

Download
memory/1196-39-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-31-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-30-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-29-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-28-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-27-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-26-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-25-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-24-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-23-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-22-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-104-0x0000000077146000-0x0000000077147000-memory.dmp

Filesize
4KB

Download
memory/1196-20-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-19-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-18-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-32-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-15-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-13-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-12-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-11-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-10-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-9-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-41-0x0000000077351000-0x0000000077352000-memory.dmp

Filesize
4KB

Download
memory/1196-50-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-53-0x00000000774B0000-0x00000000774B2000-memory.dmp

Filesize
8KB

Download
memory/1196-56-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-57-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-16-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-7-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-8-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/1196-3-0x0000000077146000-0x0000000077147000-memory.dmp

Filesize
4KB

Download
memory/1196-4-0x0000000002D40000-0x0000000002D41000-memory.dmp

Filesize
4KB

Download
memory/2028-6-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download
memory/2028-2-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2028-0-0x0000000140000000-0x0000000140082000-memory.dmp

Filesize
520KB

Download