18ba97ec9c00b85d27d9d20c62ef7bd9484ad68a33e2a2121a1bcbed19f2eacd

Resubmissions

20/06/2024, 09:01 UTC

240620-ky7wkayglc 10

20/06/2024, 08:49 UTC

240620-kq693aydpc 10

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 08:49 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dora.exe
Size

49KB
MD5

17356ef8f161730156c221300ea3cf5b
SHA1

25a05bd0a9a4167b7fd08feb44de269910701c82
SHA256

18ba97ec9c00b85d27d9d20c62ef7bd9484ad68a33e2a2121a1bcbed19f2eacd
SHA512

df964b7aac2dbbaf7a04e935dbb566e1207b0d11971f28bba9c0c136adeff475bec31c92e54be7d4da786f70d9cb339ff37e6a8f9196ceb16ab185cc956912cf
SSDEEP

768:daQRff0B31aCytHLykiKPT3JATD2qBwV2ckjbnsb0Ah99De0YADQT4J74:daD318HxZATvnsblYOJ

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1852	rundll32.exe
7	1852	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\OOBGameInstalled = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\ServiceLocation	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1852	2440	dora.exe	28
PID 2440 wrote to memory of 1852	2440	dora.exe	28
PID 2440 wrote to memory of 1852	2440	dora.exe	28
PID 2440 wrote to memory of 1852	2440	dora.exe	28
PID 2440 wrote to memory of 1852	2440	dora.exe	28
PID 2440 wrote to memory of 1852	2440	dora.exe	28
PID 2440 wrote to memory of 1852	2440	dora.exe	28

C:\Users\Admin\AppData\Local\Temp\dora.exe
"C:\Users\Admin\AppData\Local\Temp\dora.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\system32\gameux.dll,GameUXShim {0f4e74a9-a0ef-4d45-a648-227991eae33d};C:\Users\Admin\AppData\Local\Temp\dora.exe;2440
  2⤵
  - Blocklisted process makes network request
  - Modifies registry class
  PID:1852

Network

DNS

movie.metaservices.microsoft.com

rundll32.exe

Remote address:

8.8.8.8:53

Request

movie.metaservices.microsoft.com

IN A

Response

movie.metaservices.microsoft.com

IN CNAME

movie.metaservices.windowsmedia.com.akadns.net

movie.metaservices.windowsmedia.com.akadns.net

IN A

65.55.5.170

65.55.5.170:80

movie.metaservices.microsoft.com

rundll32.exe

152 B
3

8.8.8.8:53

movie.metaservices.microsoft.com

dns

rundll32.exe

78 B
154 B
1
1

DNS Request

movie.metaservices.microsoft.com

DNS Response

65.55.5.170

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

DNS Request

DNS Response

Loading Replay Monitor...