a02efa510ddb198bba1ba69829eb943384eacd278467e7ab94a33b335e77ade3

Analysis

max time kernel
92s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flash初级教材/lpk.dll
Size

46KB
MD5

da13f824f78517b9d5306532b7d56492
SHA1

8b50d78846a38a79b16ca6163ab005ecb6247677
SHA256

3f9ed957a687c9b779b1f397fd8a486cc1f9d837df76a6e4b377f9b7eb2d092b
SHA512

5a9b1c54ef5a59ba8c9d7a5a51e1e0eeac8bccce718a4159d10cb5e0049d9f0573b6075399e0e6bf207d9d872900e15dffefbf8ce410aa73f169a66f74fc00c2
SSDEEP

768:hojY9Pta9++bwNwGYN9i+Cp2+UGj0W3eE1Y2avXooyzYojY9Po:0mG++bwNwqp27GjV3P1Yj4oyzxmg

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1212	hrl89A2.tmp
2284	mmacuq.exe

Loads dropped DLL 1 IoCs

pid	Process
2284	mmacuq.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mmacuq.exe	hrl89A2.tmp
File opened for modification	C:\Windows\SysWOW64\mmacuq.exe	hrl89A2.tmp
File created	C:\Windows\SysWOW64\hra33.dll	mmacuq.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hrl89A2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmacuq.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1212	hrl89A2.tmp
1212	hrl89A2.tmp
2284	mmacuq.exe
2284	mmacuq.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 2800	3548	rundll32.exe	85
PID 3548 wrote to memory of 2800	3548	rundll32.exe	85
PID 3548 wrote to memory of 2800	3548	rundll32.exe	85
PID 2800 wrote to memory of 1212	2800	rundll32.exe	87
PID 2800 wrote to memory of 1212	2800	rundll32.exe	87
PID 2800 wrote to memory of 1212	2800	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Flash初级教材\lpk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Flash初级教材\lpk.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\hrl89A2.tmp
    C:\Users\Admin\AppData\Local\Temp\hrl89A2.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1212

C:\Windows\SysWOW64\mmacuq.exe
C:\Windows\SysWOW64\mmacuq.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hrl89A2.tmp

Filesize
38KB

MD5
754259ff98ffb8bbc408ed9dc5db85d8

SHA1
2386fdad8e0f773e1051a07308fcc57a174db484

SHA256
d5d9ee1d998059f41c3480c999cd15b9e52f163b464b0c059ccbc8e862edd535

SHA512
5e3cedbb1839364c245c5e16d5dd50db6b9597fa11cf670c8320dfb217b7166e39c7e81f979045a05877aa30d7c46d7370176e8614ff847334f6c2e0097d454e

Download Submit
C:\Windows\SysWOW64\hra33.dll

Filesize
7KB

MD5
7147ff24579a477a1a34696926e573f1

SHA1
9127ea8d813ecd5788b3f97777931ec79b7760e9

SHA256
fd08dcb016611316c849d48312ba6dc7d4de75d1a81c1d475a13bb5a1ba07267

SHA512
077b68376679c30d2dbae460ed59f5131c177bdd7574af1c2660ed97ae242b1401816d012af321c278be065b49bc9eab395e008b1b9a2447aa27b694bbed1d5d

Download Submit
memory/1212-7-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download