Analysis

  • max time kernel
    140s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 02:49

General

  • Target

    b9153c63ae5911dea43344aa7058e14dd2987652423e3178c5cc1e6cad4fc347.dll

  • Size

    16KB

  • MD5

    7d2138c790b086d6f1183e12f21fe861

  • SHA1

    7580278b5132bb59159a9fbe5f154092de0f9d0c

  • SHA256

    b9153c63ae5911dea43344aa7058e14dd2987652423e3178c5cc1e6cad4fc347

  • SHA512

    44946f4f5e30cbe02b2722cd0a63a4dce80841f72a4ba6d897a261658b22027bfe4658968cf1e47ce2bde1a3950c0f30ab823836daefa7b9bf75ec4f9d631827

  • SSDEEP

    192:n7KSdtf/wB7vzXDe3mt+D69mdzfYluDDDDDDDDDDDDDDDDDDD+yMsuyK3fBQ2fAi:neUnwB7XV1ddDfBJfA

Malware Config

Signatures

  • Modifies Windows Defender notification settings 3 TTPs 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9153c63ae5911dea43344aa7058e14dd2987652423e3178c5cc1e6cad4fc347.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9153c63ae5911dea43344aa7058e14dd2987652423e3178c5cc1e6cad4fc347.dll,#1
      2⤵
      • Modifies Windows Defender notification settings
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $ENV:TEMP
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1780
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 1008
        3⤵
        • Program crash
        PID:2912
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 760 -ip 760
    1⤵
      PID:1604

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gl30s42c.ruz.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/760-17-0x0000000074E90000-0x0000000074F19000-memory.dmp

            Filesize

            548KB

          • memory/1780-32-0x0000000006510000-0x000000000652E000-memory.dmp

            Filesize

            120KB

          • memory/1780-43-0x00000000075D0000-0x00000000075EA000-memory.dmp

            Filesize

            104KB

          • memory/1780-4-0x0000000005090000-0x00000000050B2000-memory.dmp

            Filesize

            136KB

          • memory/1780-5-0x0000000005130000-0x0000000005196000-memory.dmp

            Filesize

            408KB

          • memory/1780-6-0x00000000058E0000-0x0000000005946000-memory.dmp

            Filesize

            408KB

          • memory/1780-2-0x0000000072D40000-0x00000000734F0000-memory.dmp

            Filesize

            7.7MB

          • memory/1780-16-0x0000000005950000-0x0000000005CA4000-memory.dmp

            Filesize

            3.3MB

          • memory/1780-1-0x0000000002970000-0x00000000029A6000-memory.dmp

            Filesize

            216KB

          • memory/1780-18-0x0000000005F40000-0x0000000005F5E000-memory.dmp

            Filesize

            120KB

          • memory/1780-19-0x0000000005F80000-0x0000000005FCC000-memory.dmp

            Filesize

            304KB

          • memory/1780-20-0x0000000006F40000-0x0000000006F72000-memory.dmp

            Filesize

            200KB

          • memory/1780-33-0x0000000072D40000-0x00000000734F0000-memory.dmp

            Filesize

            7.7MB

          • memory/1780-3-0x0000000005230000-0x0000000005858000-memory.dmp

            Filesize

            6.2MB

          • memory/1780-0-0x0000000072D4E000-0x0000000072D4F000-memory.dmp

            Filesize

            4KB

          • memory/1780-22-0x0000000072D40000-0x00000000734F0000-memory.dmp

            Filesize

            7.7MB

          • memory/1780-34-0x0000000006F80000-0x0000000007023000-memory.dmp

            Filesize

            652KB

          • memory/1780-36-0x00000000078B0000-0x0000000007F2A000-memory.dmp

            Filesize

            6.5MB

          • memory/1780-35-0x0000000072D40000-0x00000000734F0000-memory.dmp

            Filesize

            7.7MB

          • memory/1780-37-0x0000000007270000-0x000000000728A000-memory.dmp

            Filesize

            104KB

          • memory/1780-38-0x00000000072F0000-0x00000000072FA000-memory.dmp

            Filesize

            40KB

          • memory/1780-39-0x00000000074F0000-0x0000000007586000-memory.dmp

            Filesize

            600KB

          • memory/1780-40-0x0000000007480000-0x0000000007491000-memory.dmp

            Filesize

            68KB

          • memory/1780-41-0x0000000004C90000-0x0000000004C9E000-memory.dmp

            Filesize

            56KB

          • memory/1780-42-0x0000000007590000-0x00000000075A4000-memory.dmp

            Filesize

            80KB

          • memory/1780-21-0x0000000075180000-0x00000000751CC000-memory.dmp

            Filesize

            304KB

          • memory/1780-44-0x00000000075B0000-0x00000000075B8000-memory.dmp

            Filesize

            32KB

          • memory/1780-47-0x0000000072D40000-0x00000000734F0000-memory.dmp

            Filesize

            7.7MB