Analysis
-
max time kernel
149s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04-06-2024 03:52
General
-
Target
d94704356d193cb7e271da4ff6f1e36722ce4508b0ea9d8768a4c59b43fba131.dll
-
Size
520KB
-
MD5
4cd048efbfcbfcf4d7c411bdad4afa7f
-
SHA1
492565cd6833e366dc27971722388152ffecc905
-
SHA256
d94704356d193cb7e271da4ff6f1e36722ce4508b0ea9d8768a4c59b43fba131
-
SHA512
5b723fa17f05003fe232b91af4c5ef6b4ee491bde5e115a14d62c42e915360d37e97184dac32ba852cb872131a7cb1081db6e87365f8158b7bb280d165122fec
-
SSDEEP
6144:Ki05kH9OyU2uv5SRf/FWgFgtBgqIRAUW9kVYeVprU4wfhTv5xD2ZP0GVGdXcukT4:VrHGPv5Smpt6DmUWuVZkxikdXcq
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 13 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 30 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d94704356d193cb7e271da4ff6f1e36722ce4508b0ea9d8768a4c59b43fba131.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\Z9Xll.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{662183c3-7773-ee8a-f0a9-0ccd273a9b7a}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{662183c3-7773-ee8a-f0a9-0ccd273a9b7a}"2⤵
-
-
C:\Windows\system32\fvenotify.exeC:\Windows\system32\fvenotify.exe1⤵
-
C:\Windows\system32\wiaacmgr.exeC:\Windows\system32\wiaacmgr.exe1⤵
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\Ur421W.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\lsW1.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Fdxhngjjnp" /SC minute /MO 60 /TR "C:\Windows\system32\1498\mstsc.exe" /RL highest3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
524KB
MD583a86dbc1c8e083771cc3bccdf538633
SHA151531399725b1a350f8172c021b4ebe92bb5d410
SHA256b189748ef2be16d0618af9b9631ea65f89e0de0b00a49cc7b68af969b9475a35
SHA5128f0e8ac452a2ceccd8ba454884f6fb22f61a6976d6ff00b2b39868926905e3caa48a5d9c7f414446a3df4c311154c4ff7ec89936166f799f5e2008947518f29b
-
Filesize
191B
MD558dfce56524dbf7b22cf19f46d370f3b
SHA165b9d7e7f8cbc9dd494432bb2b6a9a8a6304a003
SHA2569db33c382a1401fff45493037f12ec7bf877a73cee5e09782d1011ac8e3ec69a
SHA512e884d03ba2ae81f50742ff690e28b1a300851bd765f61353aee2a393b70a0f7ed37f5db0c5dd236cf9db62f289e066e38f18d8ce5a05934641825eec3f142989
-
Filesize
225B
MD5ef1a6efeecd8f813766c8e29b27f6808
SHA16864820d888118f6c8b6cd224744989821324f48
SHA256db510897ba96237b604d4189e47242e5c7432c838eed4aa93ea26a222b88b9fb
SHA5128e097d7cbf5ede1308363cba10ee64d5b2f143498dc47c045354dbb50e6eeac85b60c6853baacd99abe141cc82f771c5f9e83ce0237ea4d6cfd6cccf63cb21d1
-
Filesize
524KB
MD5df1708b19d4affe18e24774ed16b22cd
SHA11e00dfb6504c3a08f477cde060785b7d19fc8b22
SHA2566d9c4ee6d9e8119935a3e61f41a62e2c7a171cbdd7358c6be0cd9cf572ad351f
SHA5128bf917914db3a1e9c633a740b022424da473a718bdde5c7de65761485fa783044210082434cd1636df91b53d3098647c336bb9924e009c3c1db68042cbca4e91
-
Filesize
126B
MD5ed1c55917f20edef9a5c98d66d71fbd2
SHA1c86f18bfa400277289975acae20d4d8754064cba
SHA25612c2242ead9ff2b6629c572b2d34048ec0429387bf4ce7ec120f12dda3cae350
SHA51252df969bbfaddcee46ab8604d71cd9e21eb8b97d3c81f607771fca4f2368eed5334f1024371feb313069ef48ccb4a557e1692d9b228d48558e8b5175adaddf42
-
Filesize
884B
MD509edf5991d5ea0fd11800d9860105b3e
SHA1185365b8a7aecfca40a3b7d1142727b3177ecb60
SHA2565cb3f83fe1015efc5a921a60479719124a8dc905094998ecaf426b6d12523f23
SHA51200d64fbb3a4ef82640e8ebb1fbe3fc59f3942cbd2fc4a0a5c5e72661b02e54b7e78d93d5080697ae1c2cb09fdde9707b026f3b309d1520f7e5d223223ee18a0d
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
520KB
-
Filesize
28KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
4KB
-
Filesize
4KB