bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cba

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cbaN.dll
Size

93KB
MD5

c4f3b9623fadc78ec38f777eed8462e0
SHA1

2b7d0cdfa66129f95cde8e2d5a4bcb1017a2a58d
SHA256

bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cba
SHA512

db81d33d08651c9b6e25e1f3bda93fe955e4a79be6658f9c4fe2e1f69ac15c91d756940d7310b3e1fd25e81e55e0957e4b0c722fff3fd740280e09336e7fb279
SSDEEP

1536:ImZJdMmJyDl+2BZloWyHjmgVe/z9r3G/qsxS+JZ78cglmH:IIJuIyDPZFyHj9Ve/FDISMZ7

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2432	hrl1C38.tmp
2680	wwgoke.exe

Loads dropped DLL 3 IoCs

pid	Process
2292	rundll32.exe
2292	rundll32.exe
2680	wwgoke.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\J:	wwgoke.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\U:	wwgoke.exe
File opened (read-only)	\??\X:	wwgoke.exe
File opened (read-only)	\??\G:	wwgoke.exe
File opened (read-only)	\??\I:	wwgoke.exe
File opened (read-only)	\??\K:	wwgoke.exe
File opened (read-only)	\??\Q:	wwgoke.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\O:	wwgoke.exe
File opened (read-only)	\??\Y:	wwgoke.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\V:	wwgoke.exe
File opened (read-only)	\??\Z:	wwgoke.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\E:	wwgoke.exe
File opened (read-only)	\??\P:	wwgoke.exe
File opened (read-only)	\??\W:	wwgoke.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\L:	wwgoke.exe
File opened (read-only)	\??\T:	wwgoke.exe
File opened (read-only)	\??\M:	wwgoke.exe
File opened (read-only)	\??\R:	wwgoke.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\H:	wwgoke.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\N:	wwgoke.exe
File opened (read-only)	\??\S:	wwgoke.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wwgoke.exe	hrl1C38.tmp
File opened for modification	C:\Windows\SysWOW64\wwgoke.exe	hrl1C38.tmp
File created	C:\Windows\SysWOW64\hra33.dll	wwgoke.exe

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lpk.dll	wwgoke.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\lpk.dll	wwgoke.exe
File created	C:\Program Files\7-Zip\lpk.dll	wwgoke.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\lpk.dll	wwgoke.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\lpk.dll	wwgoke.exe
File created	C:\Program Files\Google\Chrome\Application\lpk.dll	wwgoke.exe
File created	C:\Program Files\Internet Explorer\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Internet Explorer\lpk.dll	wwgoke.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Java\jre7\bin\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\DVD Maker\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\lpk.dll	wwgoke.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\lpk.dll	wwgoke.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\lpk.dll	wwgoke.exe
File created	C:\Program Files\Java\jre7\bin\lpk.dll	wwgoke.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\lpk.dll	wwgoke.exe
File created	C:\Program Files\DVD Maker\lpk.dll	wwgoke.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\lpk.dll	wwgoke.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\lpk.dll	wwgoke.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\lpk.dll	wwgoke.exe
File opened for modification	C:\Program Files\7-Zip\lpk.dll	wwgoke.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hrl1C38.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wwgoke.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2432	hrl1C38.tmp
2680	wwgoke.exe

Suspicious behavior: MapViewOfSection 51 IoCs

pid	Process
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe
2680	wwgoke.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	hrl1C38.tmp
Token: SeDebugPrivilege	2680	wwgoke.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2432	hrl1C38.tmp
2432	hrl1C38.tmp
2680	wwgoke.exe
2680	wwgoke.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2292	2180	rundll32.exe	29
PID 2180 wrote to memory of 2292	2180	rundll32.exe	29
PID 2180 wrote to memory of 2292	2180	rundll32.exe	29
PID 2180 wrote to memory of 2292	2180	rundll32.exe	29
PID 2180 wrote to memory of 2292	2180	rundll32.exe	29
PID 2180 wrote to memory of 2292	2180	rundll32.exe	29
PID 2180 wrote to memory of 2292	2180	rundll32.exe	29
PID 2292 wrote to memory of 2432	2292	rundll32.exe	30
PID 2292 wrote to memory of 2432	2292	rundll32.exe	30
PID 2292 wrote to memory of 2432	2292	rundll32.exe	30
PID 2292 wrote to memory of 2432	2292	rundll32.exe	30
PID 2432 wrote to memory of 372	2432	hrl1C38.tmp	3
PID 2432 wrote to memory of 372	2432	hrl1C38.tmp	3
PID 2432 wrote to memory of 372	2432	hrl1C38.tmp	3
PID 2432 wrote to memory of 372	2432	hrl1C38.tmp	3
PID 2432 wrote to memory of 372	2432	hrl1C38.tmp	3
PID 2432 wrote to memory of 372	2432	hrl1C38.tmp	3
PID 2432 wrote to memory of 372	2432	hrl1C38.tmp	3
PID 2432 wrote to memory of 384	2432	hrl1C38.tmp	4
PID 2432 wrote to memory of 384	2432	hrl1C38.tmp	4
PID 2432 wrote to memory of 384	2432	hrl1C38.tmp	4
PID 2432 wrote to memory of 384	2432	hrl1C38.tmp	4
PID 2432 wrote to memory of 384	2432	hrl1C38.tmp	4
PID 2432 wrote to memory of 384	2432	hrl1C38.tmp	4
PID 2432 wrote to memory of 384	2432	hrl1C38.tmp	4
PID 2432 wrote to memory of 420	2432	hrl1C38.tmp	5
PID 2432 wrote to memory of 420	2432	hrl1C38.tmp	5
PID 2432 wrote to memory of 420	2432	hrl1C38.tmp	5
PID 2432 wrote to memory of 420	2432	hrl1C38.tmp	5
PID 2432 wrote to memory of 420	2432	hrl1C38.tmp	5
PID 2432 wrote to memory of 420	2432	hrl1C38.tmp	5
PID 2432 wrote to memory of 420	2432	hrl1C38.tmp	5
PID 2432 wrote to memory of 464	2432	hrl1C38.tmp	6
PID 2432 wrote to memory of 464	2432	hrl1C38.tmp	6
PID 2432 wrote to memory of 464	2432	hrl1C38.tmp	6
PID 2432 wrote to memory of 464	2432	hrl1C38.tmp	6
PID 2432 wrote to memory of 464	2432	hrl1C38.tmp	6
PID 2432 wrote to memory of 464	2432	hrl1C38.tmp	6
PID 2432 wrote to memory of 464	2432	hrl1C38.tmp	6
PID 2432 wrote to memory of 480	2432	hrl1C38.tmp	7
PID 2432 wrote to memory of 480	2432	hrl1C38.tmp	7
PID 2432 wrote to memory of 480	2432	hrl1C38.tmp	7
PID 2432 wrote to memory of 480	2432	hrl1C38.tmp	7
PID 2432 wrote to memory of 480	2432	hrl1C38.tmp	7
PID 2432 wrote to memory of 480	2432	hrl1C38.tmp	7
PID 2432 wrote to memory of 480	2432	hrl1C38.tmp	7
PID 2432 wrote to memory of 488	2432	hrl1C38.tmp	8
PID 2432 wrote to memory of 488	2432	hrl1C38.tmp	8
PID 2432 wrote to memory of 488	2432	hrl1C38.tmp	8
PID 2432 wrote to memory of 488	2432	hrl1C38.tmp	8
PID 2432 wrote to memory of 488	2432	hrl1C38.tmp	8
PID 2432 wrote to memory of 488	2432	hrl1C38.tmp	8
PID 2432 wrote to memory of 488	2432	hrl1C38.tmp	8
PID 2432 wrote to memory of 592	2432	hrl1C38.tmp	9
PID 2432 wrote to memory of 592	2432	hrl1C38.tmp	9
PID 2432 wrote to memory of 592	2432	hrl1C38.tmp	9
PID 2432 wrote to memory of 592	2432	hrl1C38.tmp	9
PID 2432 wrote to memory of 592	2432	hrl1C38.tmp	9
PID 2432 wrote to memory of 592	2432	hrl1C38.tmp	9
PID 2432 wrote to memory of 592	2432	hrl1C38.tmp	9
PID 2432 wrote to memory of 672	2432	hrl1C38.tmp	10
PID 2432 wrote to memory of 672	2432	hrl1C38.tmp	10
PID 2432 wrote to memory of 672	2432	hrl1C38.tmp	10
PID 2432 wrote to memory of 672	2432	hrl1C38.tmp	10

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:592
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:840
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1480
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:756
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:812
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1216
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:844
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:988
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:284
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1016
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1032
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1128
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:2040
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1196
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\wwgoke.exe
    C:\Windows\SysWOW64\wwgoke.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2680
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cbaN.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cbaN.dll,#1
    3⤵
    - Loads dropped DLL
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\hrl1C38.tmp
      C:\Users\Admin\AppData\Local\Temp\hrl1C38.tmp
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hrl1C38.tmp

Filesize
85KB

MD5
a1c541bc7c723396464af1a0cd736842

SHA1
d1170dedcfe3d11b000f9235e2cd1be43c13e134

SHA256
6b762ae5e8f14098e75be421ad71ccd4fde4a8afcbe197bad3648378480b568b

SHA512
efeaa0ba159a1fcd365de4f40812b0b1bd3bf906e875262583b4636899096712deefec19375c5f1677dd8dcd0cc14a3b5740bd239c8c965dd4faabedacd2c8c8

Download Submit
\Windows\SysWOW64\hra33.dll

Filesize
93KB

MD5
c4f3b9623fadc78ec38f777eed8462e0

SHA1
2b7d0cdfa66129f95cde8e2d5a4bcb1017a2a58d

SHA256
bdefef2c15c070b8a8311c32e5c72973ecf2b3c26ae59cb47ffe9a7fd30f7cba

SHA512
db81d33d08651c9b6e25e1f3bda93fe955e4a79be6658f9c4fe2e1f69ac15c91d756940d7310b3e1fd25e81e55e0957e4b0c722fff3fd740280e09336e7fb279

Download Submit
memory/2292-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2292-3-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2292-75-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2432-11-0x0000000076F90000-0x0000000076F91000-memory.dmp

Filesize
4KB

Download
memory/2432-10-0x0000000076F8F000-0x0000000076F90000-memory.dmp

Filesize
4KB

Download
memory/2432-17-0x000000007EF90000-0x000000007EF9C000-memory.dmp

Filesize
48KB

Download
memory/2432-16-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2680-76-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download