Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 21:38
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_313322ef85ad7c943bc930fc900f7940.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
VirusShare_313322ef85ad7c943bc930fc900f7940.dll
Resource
win10v2004-20240508-en
General
-
Target
VirusShare_313322ef85ad7c943bc930fc900f7940.dll
-
Size
88KB
-
MD5
313322ef85ad7c943bc930fc900f7940
-
SHA1
8170be7ecc998cb89e155c6f1b5cf0e5e7c9600e
-
SHA256
baed2b676b376de604b41c4bf0f66d106085d96402acecae77ddc749fff50f74
-
SHA512
39a1e60cd5361be117b628e8b14972c74c7274ddf31a42ddc4e44d800b539605090a2b98a9b7f4c937228b0ee88d913ef14340cf7cce0a5deeb4f368913acfbd
-
SSDEEP
1536:KMxqUyvZNNm8CR0DBe6mC5ktbg5llhZNfvoipKKa3:KMQxjCiVHCg5PhLv5kKa
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 1728 rundll32.exe 1528 rundll32.exe 4224 rundll32.exe 1368 rundll32.exe 1224 rundll32.exe 4984 rundll32.exe -
Loads dropped DLL 14 IoCs
pid Process 5112 rundll32.exe 5112 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1528 rundll32.exe 1528 rundll32.exe 4224 rundll32.exe 4224 rundll32.exe 4984 rundll32.exe 4984 rundll32.exe 1368 rundll32.exe 1368 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe -
resource yara_rule behavioral2/memory/5112-2-0x00000000010D0000-0x00000000010FB000-memory.dmp upx behavioral2/memory/5112-9-0x00000000010D0000-0x00000000010FE000-memory.dmp upx behavioral2/memory/1728-19-0x0000000000D70000-0x0000000000D9B000-memory.dmp upx behavioral2/memory/5112-41-0x00000000030D0000-0x00000000030FE000-memory.dmp upx behavioral2/memory/1728-42-0x0000000000D70000-0x0000000000D9E000-memory.dmp upx behavioral2/memory/1528-43-0x0000000000A50000-0x0000000000A7E000-memory.dmp upx behavioral2/memory/4224-44-0x00000000006B0000-0x00000000006DE000-memory.dmp upx behavioral2/memory/4984-45-0x0000000001110000-0x000000000113E000-memory.dmp upx behavioral2/memory/1368-46-0x0000000002440000-0x000000000246E000-memory.dmp upx behavioral2/memory/1224-47-0x0000000000CA0000-0x0000000000CCE000-memory.dmp upx behavioral2/memory/1368-53-0x0000000002440000-0x000000000246E000-memory.dmp upx behavioral2/memory/5112-56-0x00000000010D0000-0x00000000010FB000-memory.dmp upx behavioral2/memory/1224-54-0x0000000000CA0000-0x0000000000CCE000-memory.dmp upx behavioral2/memory/1728-61-0x0000000000D70000-0x0000000000D9B000-memory.dmp upx behavioral2/memory/1368-72-0x0000000002440000-0x000000000246E000-memory.dmp upx behavioral2/memory/1224-85-0x0000000000CA0000-0x0000000000CCE000-memory.dmp upx behavioral2/memory/1224-93-0x0000000000CA0000-0x0000000000CCE000-memory.dmp upx behavioral2/memory/1224-105-0x0000000000CA0000-0x0000000000CCE000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\PROGRA~3\\rundll32.exe C:\\PROGRA~3\\jejmrv.dat,FG00" rundll32.exe -
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\PROGRA~3\rundll32.exe rundll32.exe File created C:\PROGRA~3\as98213.txt rundll32.exe File created C:\PROGRA~3\vrmjej.js rundll32.exe File created C:\PROGRA~3\vrmjej.bat rundll32.exe File created C:\PROGRA~3\vrmjej.reg rundll32.exe File created C:\PROGRA~3\jejmrv.dat rundll32.exe File created C:\PROGRA~3\vrmjej.pad rundll32.exe File opened for modification C:\PROGRA~3\vrmjej.pad rundll32.exe File opened for modification C:\PROGRA~3\vrmjej.pad rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" rundll32.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424217387" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C6C0909F-2771-11EF-9519-62BC6A84A035} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3924 iexplore.exe 3924 iexplore.exe 3924 iexplore.exe 3924 iexplore.exe 3924 iexplore.exe 3924 iexplore.exe 3924 iexplore.exe 3924 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3924 iexplore.exe 3924 iexplore.exe 4352 IEXPLORE.EXE 4352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 116 wrote to memory of 5112 116 rundll32.exe 82 PID 116 wrote to memory of 5112 116 rundll32.exe 82 PID 116 wrote to memory of 5112 116 rundll32.exe 82 PID 5112 wrote to memory of 1728 5112 rundll32.exe 86 PID 5112 wrote to memory of 1728 5112 rundll32.exe 86 PID 5112 wrote to memory of 1728 5112 rundll32.exe 86 PID 1728 wrote to memory of 1528 1728 rundll32.exe 87 PID 1728 wrote to memory of 1528 1728 rundll32.exe 87 PID 1728 wrote to memory of 1528 1728 rundll32.exe 87 PID 1728 wrote to memory of 4224 1728 rundll32.exe 88 PID 1728 wrote to memory of 4224 1728 rundll32.exe 88 PID 1728 wrote to memory of 4224 1728 rundll32.exe 88 PID 1728 wrote to memory of 4984 1728 rundll32.exe 89 PID 1728 wrote to memory of 4984 1728 rundll32.exe 89 PID 1728 wrote to memory of 4984 1728 rundll32.exe 89 PID 1728 wrote to memory of 1368 1728 rundll32.exe 90 PID 1728 wrote to memory of 1368 1728 rundll32.exe 90 PID 1728 wrote to memory of 1368 1728 rundll32.exe 90 PID 1728 wrote to memory of 1224 1728 rundll32.exe 91 PID 1728 wrote to memory of 1224 1728 rundll32.exe 91 PID 1728 wrote to memory of 1224 1728 rundll32.exe 91 PID 4984 wrote to memory of 3924 4984 rundll32.exe 92 PID 4984 wrote to memory of 3924 4984 rundll32.exe 92 PID 3924 wrote to memory of 4352 3924 iexplore.exe 93 PID 3924 wrote to memory of 4352 3924 iexplore.exe 93 PID 3924 wrote to memory of 4352 3924 iexplore.exe 93 PID 4984 wrote to memory of 3924 4984 rundll32.exe 92 PID 4984 wrote to memory of 3924 4984 rundll32.exe 92
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_313322ef85ad7c943bc930fc900f7940.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_313322ef85ad7c943bc930fc900f7940.dll,#12⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\jejmrv.dat,FG003⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\jejmrv.dat,FG014⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528
-
-
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\jejmrv.dat,FG024⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:4224
-
-
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\jejmrv.dat,FG034⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3924 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4352
-
-
-
-
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\jejmrv.dat,FG044⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368
-
-
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\jejmrv.dat,FG064⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5313322ef85ad7c943bc930fc900f7940
SHA18170be7ecc998cb89e155c6f1b5cf0e5e7c9600e
SHA256baed2b676b376de604b41c4bf0f66d106085d96402acecae77ddc749fff50f74
SHA51239a1e60cd5361be117b628e8b14972c74c7274ddf31a42ddc4e44d800b539605090a2b98a9b7f4c937228b0ee88d913ef14340cf7cce0a5deeb4f368913acfbd
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641