6b7c4ce5419e7cde80856a85559203dca5219d05115cdd6c1598f2e789149c34

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 13:44

Target

wwlib.dll
Size

25KB
MD5

8ae76848a8f5f80bccf089c8aaec6d94
SHA1

3a47a3e498445041373d323192f55219b6842a6d
SHA256

8dc3f6179120f03fd6cb2299dbc94425451d84d6852b801a313a39e9df5d9b1a
SHA512

b6152c993d8dc6a2955abecc08513f31994bb1d6ba623aec48faaa1f35195245bc1d81c14e05dcb4ebe6fd3f19e8239278fa74cd31c88386f4d236be9a824851
SSDEEP

384:YW4wIDLBUBx6IE9x7LUEr1mRP0jqqVEL/j/y/rSM60fnKE6Ifh61E8iBpjhD7gsW:/Iv+ewvWKOfs1EDlD7ny

Score

10^/10

persistence

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, explorer.exe /e,/root,%PSH% -nop -w h \"Start-Process -N -F $env:SYSB -A $env:TPM\""	rundll32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
712	SCHTASKS.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 712	1216	rundll32.exe	83
PID 1216 wrote to memory of 712	1216	rundll32.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wwlib.dll,#1
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\system32\SCHTASKS.exe
  SCHTASKS /CREATE /f /TN "OneDriver Reporting Task" /TR "shutdown /l /f" /SC WEEKLY /d TUE,FRI /ST 13:25
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:712