cf90f5af2f0e3573b89378d5204d1138b984c0426843276e82ea4787767e0ba2

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lpk.dll
Size

47KB
MD5

c4d0087ebcdcaa94f2a5ef3a4ceb1dc3
SHA1

165a0063bd69009b152a9b70df6e690945d92371
SHA256

840770730c51c02492f171382a2c490ab7243853facbd1f2ab2b7cac91f94a97
SHA512

b8fa657629a2c5f96c9a14be385c533f02365dc42ba7fa3a50dddabe889cb6e7a0f4b91156407a94b930a101850cdef407b771c48ea0c994875bc3bc1be082d3
SSDEEP

768:lojY9PXAum/U12tZAW/BXcTjX/O8KDbZScn6yHEojY9Po:wmXiI2tZ7XqYZhn6yH1mg

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2752	hrlF289.tmp
2556	sssscc.exe

Loads dropped DLL 2 IoCs

pid	Process
2816	rundll32.exe
2816	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sssscc.exe	hrlF289.tmp
File opened for modification	C:\Windows\SysWOW64\sssscc.exe	hrlF289.tmp

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2556 set thread context of 2996	2556	sssscc.exe	33

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hrlF289.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sssscc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2752	hrlF289.tmp
2752	hrlF289.tmp
2556	sssscc.exe
2556	sssscc.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2816	2772	rundll32.exe	30
PID 2772 wrote to memory of 2816	2772	rundll32.exe	30
PID 2772 wrote to memory of 2816	2772	rundll32.exe	30
PID 2772 wrote to memory of 2816	2772	rundll32.exe	30
PID 2772 wrote to memory of 2816	2772	rundll32.exe	30
PID 2772 wrote to memory of 2816	2772	rundll32.exe	30
PID 2772 wrote to memory of 2816	2772	rundll32.exe	30
PID 2816 wrote to memory of 2752	2816	rundll32.exe	31
PID 2816 wrote to memory of 2752	2816	rundll32.exe	31
PID 2816 wrote to memory of 2752	2816	rundll32.exe	31
PID 2816 wrote to memory of 2752	2816	rundll32.exe	31
PID 2556 wrote to memory of 2996	2556	sssscc.exe	33
PID 2556 wrote to memory of 2996	2556	sssscc.exe	33
PID 2556 wrote to memory of 2996	2556	sssscc.exe	33
PID 2556 wrote to memory of 2996	2556	sssscc.exe	33
PID 2556 wrote to memory of 2996	2556	sssscc.exe	33
PID 2556 wrote to memory of 2996	2556	sssscc.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Users\Admin\AppData\Local\Temp\hrlF289.tmp
    C:\Users\Admin\AppData\Local\Temp\hrlF289.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2752

C:\Windows\SysWOW64\sssscc.exe
C:\Windows\SysWOW64\sssscc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hrlF289.tmp

Filesize
39KB

MD5
d4a807f7691bd14ddf29858ef6a497d0

SHA1
f817b9335ce4d1aa4e12e49478803944a12b7fa7

SHA256
1b00f30cab8b897ada72794a4cc89436606886f6f1d59da991f28e0bf572300a

SHA512
f27171e048a5a14900d08c671d7dfb53efaf960a70f3c68128405f7718d0d67db423b994adc312f4a7bbc9804119cb066fda0b48beff7bc74907765a3b6b82e6

Download Submit
memory/2752-17-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2996-16-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2996-14-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2996-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download