Analysis

  • max time kernel
    138s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 02:40

General

  • Target

    a.dll

  • Size

    16KB

  • MD5

    d7a5aa9937568b1e34ad845c67d59024

  • SHA1

    f56692fce5147afd558df4b9be45490155f9dae5

  • SHA256

    41794b5b46fb063d7e934eef590f059fa8e6875aff628adcf85b8449f7d3b027

  • SHA512

    5313ec50eceaf024bda3dd0e1893de660b3dd3b9c21251293122e155d2578bd943f33e6766606f28583c1e44433aa2da38bfe650ebae192eea7e2f40dfa4810f

  • SSDEEP

    192:C7KSdtf/wB7vzXDe3mt+D69mdzfYluDDDDDDDDDDDDDDDDDDD+yMsuyK32BQ2fAi:CeUnwB7XV1ddD2BJfA

Malware Config

Signatures

  • Modifies Windows Defender notification settings 3 TTPs 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\a.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\a.dll,#1
      2⤵
      • Modifies Windows Defender notification settings
      • Checks computer location settings
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3928
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:TEMP
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2236
      • C:\Windows\SysWOW64\cscript.exe
        cscript.exe C:\Users\Admin\AppData\Local\Temp\gapCE1E.tmp.vbs //B //Nologo //T:5
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2212
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gpmsc_externalDBMSleanup.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:316
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 1
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:2720
      • C:\Users\Admin\AppData\Local\Temp\nqpD545.tmp
        C:\Users\Admin\AppData\Local\Temp\nqpD545.tmp C:\Users\Admin\AppData\Local\Temp\iwqD544.tmp
        3⤵
        • Executes dropped EXE
        PID:3612
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /Q /C "timeout 1 && del /Q /F a"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:2816

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\CB8D.tmp

          Filesize

          58KB

          MD5

          1525bb483c55784d134e3bd3dc447b54

          SHA1

          2decac84434ceda70ac31c6285b2b234a911a999

          SHA256

          14f60bf6d8700c82b426a6f724ee51c97b342a9a85dacd4ab7422a8c4961a099

          SHA512

          d0db58a59c69f52ec3924120d3833e7a8ced70488513b89c3e7854568edbc447f405e7e3af425f4c3024275b29ef0eb13b836a0922328dcdeb1a0100d3c115ed

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qz35d4za.jzo.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\gapCE1E.tmp.vbs

          Filesize

          386B

          MD5

          0a1c237316e11ec81b1df21773710c40

          SHA1

          3eb16f259114b6a4f5ef5b7f3721dc6dcb06f7bc

          SHA256

          1cf290b40445860679be3bed68c03a0e555c7a3fa91aba8c216a34cc345a4dbe

          SHA512

          57004762360c0f74f5d797b7e5d7a56e8ae9090bff9121baa49912717cf919d136508ecf71ca1702549e85e20a4ba15769ef87b8a838e00e8e2542fdb25d9b2d

        • C:\Users\Admin\AppData\Local\Temp\gpmsc_externalDBMSleanup.bat

          Filesize

          475B

          MD5

          c5148520a262094d3cf9155a4f6c6b51

          SHA1

          dcd5cb466c4b625d4dd49d3ff89b766c539b6dee

          SHA256

          ae674f232bf01c2fc7d1fdd88bdf3136261bb8b9733d7d2047981909a6913f9f

          SHA512

          aa34638a57240691ef93ff5d3bc593cfd8995868b94c52b862ff8820059837c4fb2c90b602894a6a0fc6c7cf9876fa8f10dbf5f15400f2f522546747da089924

        • C:\Users\Admin\AppData\Local\Temp\nqpD545.tmp

          Filesize

          6KB

          MD5

          ac61560a8f57ad2dfd91e63aa3dc60f1

          SHA1

          7e797ddb74ae5fb43190d799334555430f302704

          SHA256

          188f350da1f06a9a10ad9da6120aed854a8108977241d6b9a445a09fdd7f7cda

          SHA512

          bc7bcc661c64e4f0f27c5bf07c0e5ea450e99b602bca17846ec6536675c16632a50c84aba679cfa933bd488994e90dfda7dc28d9254b0eeb3e05efd18767e755

        • C:\Users\Admin\AppData\Local\Temp\secuserpol5791.cfg

          Filesize

          104B

          MD5

          5f21b391cba1bde137694df8db69cf0f

          SHA1

          bf409326a188f60a664c977e9fbe8ca242032bbf

          SHA256

          7088b0827081ca44062e696bac6a2c0e4922d2513d491bbeafbed142ec9b9cc1

          SHA512

          4423b855b38fb68a7e6e1405f57c92aa48fc378b529d0633063474e20b90018bde3850abac16212b705e021901bfd1141694d30cb85a703476e270b491d43897

        • memory/2236-13-0x0000000004EC0000-0x0000000004EE2000-memory.dmp

          Filesize

          136KB

        • memory/2236-41-0x0000000006D90000-0x0000000006DC2000-memory.dmp

          Filesize

          200KB

        • memory/2236-19-0x00000000056D0000-0x0000000005736000-memory.dmp

          Filesize

          408KB

        • memory/2236-20-0x0000000005740000-0x00000000057A6000-memory.dmp

          Filesize

          408KB

        • memory/2236-11-0x00000000731E0000-0x0000000073990000-memory.dmp

          Filesize

          7.7MB

        • memory/2236-10-0x00000000050A0000-0x00000000056C8000-memory.dmp

          Filesize

          6.2MB

        • memory/2236-30-0x00000000057B0000-0x0000000005B04000-memory.dmp

          Filesize

          3.3MB

        • memory/2236-9-0x0000000000E90000-0x0000000000EC6000-memory.dmp

          Filesize

          216KB

        • memory/2236-66-0x00000000731E0000-0x0000000073990000-memory.dmp

          Filesize

          7.7MB

        • memory/2236-7-0x00000000731EE000-0x00000000731EF000-memory.dmp

          Filesize

          4KB

        • memory/2236-39-0x0000000005D20000-0x0000000005D3E000-memory.dmp

          Filesize

          120KB

        • memory/2236-40-0x0000000005DF0000-0x0000000005E3C000-memory.dmp

          Filesize

          304KB

        • memory/2236-42-0x0000000072F30000-0x0000000072F7C000-memory.dmp

          Filesize

          304KB

        • memory/2236-12-0x00000000731E0000-0x0000000073990000-memory.dmp

          Filesize

          7.7MB

        • memory/2236-52-0x0000000006360000-0x000000000637E000-memory.dmp

          Filesize

          120KB

        • memory/2236-53-0x0000000006DD0000-0x0000000006E73000-memory.dmp

          Filesize

          652KB

        • memory/2236-54-0x0000000007700000-0x0000000007D7A000-memory.dmp

          Filesize

          6.5MB

        • memory/2236-55-0x00000000070D0000-0x00000000070EA000-memory.dmp

          Filesize

          104KB

        • memory/2236-56-0x0000000007130000-0x000000000713A000-memory.dmp

          Filesize

          40KB

        • memory/2236-57-0x0000000007330000-0x00000000073C6000-memory.dmp

          Filesize

          600KB

        • memory/2236-58-0x00000000072C0000-0x00000000072D1000-memory.dmp

          Filesize

          68KB

        • memory/2236-59-0x00000000072F0000-0x00000000072FE000-memory.dmp

          Filesize

          56KB

        • memory/2236-60-0x0000000007300000-0x0000000007314000-memory.dmp

          Filesize

          80KB

        • memory/2236-61-0x00000000073F0000-0x000000000740A000-memory.dmp

          Filesize

          104KB

        • memory/2236-62-0x00000000073D0000-0x00000000073D8000-memory.dmp

          Filesize

          32KB

        • memory/3612-38-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB