39e1780e7003dfbeb31a0b0c1d1c9c72c7eeaafa30cd1408757b9ceb56916e93

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TKMahjongDll.dll
Size

376KB
MD5

780cefe6264ed47928e41018bc3c1814
SHA1

897141fa2995194cc8584459377cba44a97433e1
SHA256

9eafb555cd905b879c6d0583c30e6c663aecd7ec7ccd45ff599cf0ded5cbff83
SHA512

b9db7a796325966c9383f3f87bdf8908249ef63b1d4c40c349392ce5f4b281079b676629ac49a85a082c69eeca010c9b64ddf14bdd73d3e2f5ff1e1dce622d11
SSDEEP

6144:nCchuiA6nLd8U/Fu4FFlYATK98FqBcGKWPriqJX+duYfu9:EiAunFu47tTBqBcGUqcdU9

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\JJMatch\Mahjong.log	rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 3736	1964	rundll32.exe	87
PID 1964 wrote to memory of 3736	1964	rundll32.exe	87
PID 1964 wrote to memory of 3736	1964	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TKMahjongDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TKMahjongDll.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads