Overview

overview

8

Static

static

3

LoaderV6/A...wk.dll

windows10-1703-x64

4

LoaderV6/A...ci.dll

windows10-1703-x64

1

LoaderV6/A...ui.dll

windows10-1703-x64

1

LoaderV6/WMPNSSUI.dll

windows10-1703-x64

1

LoaderV6/loaderV6.exe

windows10-1703-x64

8

LoaderV6/mpvis.dll

windows10-1703-x64

1

LoaderV6/wmpnssci.dll

windows10-1703-x64

1

Analysis

  • max time kernel
    145s
  • max time network
    137s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-07-2024 21:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    LoaderV6/Additions/wmpnetwk.dll

  • Size

    32KB

  • MD5

    8cd455334b6cdd06beeeb898e1e83052

  • SHA1

    e104ab973744bac982efa50f055a5a45daed2aee

  • SHA256

    5270f60d90a15ce9d728c328495fb714daa1267a7363a70225badfa252a38ad0

  • SHA512

    922f329f32d935946490cb7ff409689f2c2610fd09efe7e9e095a6e10aee838dde585aa6cbc4e816c42c7a61aa989daf3633edd553ed4a355d7eed6225091859

  • SSDEEP

    192:400xT+MOj4Edw+bRFCPkzMTYEwdwbFS33eWTqa2ilecbAvyv/PjxNlMopnTXmCly:400xvnyK9EN5VlVECXIWeF

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\LoaderV6\Additions\wmpnetwk.dll,#1
    1⤵
      PID:212
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2144
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1112
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
        • Modifies Internet Explorer settings
        PID:2792
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2452
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:8
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:616

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFA1AF66008C55C155.TMP
        Filesize

        24KB

        MD5

        3936eb12bed47533f60403b8533cb156

        SHA1

        1e63c9b46e560046db0db578f3ef843caca93a04

        SHA256

        0289fe4ce7c3928efd0d5c24e4fc6c8bcbd73a38cd93ac7025368dcde1e86d5a

        SHA512

        51698dc245e530a27d0c20657a66fec22ea099c9499b59d755ff4880e65aa6830a603d1de5c6a84110aea0394130e5332005e4efc9f287ea171a34d07f29ab23

        Download Submit

      • memory/8-44-0x0000024D73F00000-0x0000024D74000000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/616-50-0x0000026478670000-0x0000026478770000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/616-53-0x0000026478230000-0x0000026478232000-memory.dmp

        Filesize

        8KB

        Download

      • memory/616-58-0x0000026478280000-0x0000026478282000-memory.dmp

        Filesize

        8KB

        Download

      • memory/616-56-0x0000026478260000-0x0000026478262000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1112-16-0x000002231DB20000-0x000002231DB30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1112-0-0x000002231DA20000-0x000002231DA30000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1112-35-0x000002231CB30000-0x000002231CB32000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1112-72-0x000002231CBC0000-0x000002231CBC2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1112-75-0x000002231CB60000-0x000002231CB61000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1112-79-0x000002231CB20000-0x000002231CB21000-memory.dmp

        Filesize

        4KB

        Download