Resubmissions
28/10/2024, 17:20
241028-vwegcathpa 1020/06/2024, 04:07
240620-epwt2sxhkc 820/06/2024, 03:56
240620-ehtfcaxemb 314/06/2024, 11:45
240614-nw7dssyhre 826/05/2024, 08:12
240526-j36nmada24 8Analysis
-
max time kernel
299s -
max time network
306s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 04:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13.dll
Resource
win7-20240611-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
300 seconds
General
-
Target
ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13.dll
-
Size
141KB
-
MD5
1b7b6fb1a99996587a3c20ee9c390a9c
-
SHA1
129aa22329dd45f7bce5172e97cbd8016dec830e
-
SHA256
ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13
-
SHA512
a3b62e1c1184c01b0175b09f0a62003e120e652245ea80cebf9e55c89ef71308c4400bfe13281a60ae993c58d7dad5522688fa2e8924343e1baa5c25bfce44eb
-
SSDEEP
3072:HACxLpcTIhjZM3VhHSkYl8CagwurZvE9vV1ZQZR:HTtpcPlJSTl4PuF
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 47 IoCs
flow pid Process 4 2552 rundll32.exe 5 2552 rundll32.exe 6 2552 rundll32.exe 7 2552 rundll32.exe 8 2552 rundll32.exe 9 2552 rundll32.exe 10 2552 rundll32.exe 11 2552 rundll32.exe 12 2552 rundll32.exe 13 2552 rundll32.exe 14 2552 rundll32.exe 15 2552 rundll32.exe 16 2552 rundll32.exe 17 2552 rundll32.exe 18 2552 rundll32.exe 19 2552 rundll32.exe 20 2552 rundll32.exe 21 2552 rundll32.exe 22 2552 rundll32.exe 23 2552 rundll32.exe 24 2552 rundll32.exe 25 2552 rundll32.exe 26 2552 rundll32.exe 27 2552 rundll32.exe 28 2552 rundll32.exe 29 2552 rundll32.exe 30 2552 rundll32.exe 31 2552 rundll32.exe 32 2552 rundll32.exe 33 2552 rundll32.exe 34 2552 rundll32.exe 35 2552 rundll32.exe 36 2552 rundll32.exe 37 2552 rundll32.exe 38 2552 rundll32.exe 39 2552 rundll32.exe 40 2552 rundll32.exe 41 2552 rundll32.exe 42 2552 rundll32.exe 43 2552 rundll32.exe 44 2552 rundll32.exe 45 2552 rundll32.exe 46 2552 rundll32.exe 47 2552 rundll32.exe 48 2552 rundll32.exe 49 2552 rundll32.exe 50 2552 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe 2552 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\347YJLE9.htm rundll32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\RtlUpd.job regsvr32.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Modifies data under HKEY_USERS 21 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30A9140C-4C97-46B4-BFB6-CACA92EE110D}\WpadDecisionReason = "1" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30A9140C-4C97-46B4-BFB6-CACA92EE110D}\WpadDecisionTime = d0ee4f9ec7c2da01 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30A9140C-4C97-46B4-BFB6-CACA92EE110D}\WpadNetworkName = "Network 3" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-32-45-d9-03-85\WpadDecisionReason = "1" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30A9140C-4C97-46B4-BFB6-CACA92EE110D} rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30A9140C-4C97-46B4-BFB6-CACA92EE110D}\WpadDecision = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{30A9140C-4C97-46B4-BFB6-CACA92EE110D}\46-32-45-d9-03-85 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-32-45-d9-03-85\WpadDecisionTime = d0ee4f9ec7c2da01 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-32-45-d9-03-85\WpadDecision = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-32-45-d9-03-85 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2552 2672 taskeng.exe 31 PID 2672 wrote to memory of 2552 2672 taskeng.exe 31 PID 2672 wrote to memory of 2552 2672 taskeng.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 C:\Users\Admin\AppData\Local\Temp\ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13.dll1⤵
- Drops file in Windows directory
PID:1176
-
C:\Windows\system32\taskeng.exetaskeng.exe {4AC62E3A-2CC2-407C-BDE0-DDD414DFD379} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe "C:\ProgramData\RtlUpd\RtlUpd.dll",Start /p2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD51b7b6fb1a99996587a3c20ee9c390a9c
SHA1129aa22329dd45f7bce5172e97cbd8016dec830e
SHA256ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13
SHA512a3b62e1c1184c01b0175b09f0a62003e120e652245ea80cebf9e55c89ef71308c4400bfe13281a60ae993c58d7dad5522688fa2e8924343e1baa5c25bfce44eb