Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 02:09
Behavioral task
behavioral1
Sample
aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe
Resource
win7-20241023-en
windows7-x64
16 signatures
150 seconds
General
-
Target
aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe
-
Size
38KB
-
MD5
51b4b6d3139c77d3bb6fe3b6bd7a3651
-
SHA1
3d75b85da0618a66719a590104692c652b4d91b1
-
SHA256
aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912
-
SHA512
602a25e4606bc0d3713461af8d82c6b276f072fb38467c24e05258aa487d43925e6b6e5d61eaf38aa9a34aaa84d33939ff1a8240269ee3e998a3c9ffc5369b00
-
SSDEEP
768:aHpqwkfEY6GmDvRwlNoJfiqFMkBh5e6BXZgB4e:aHpXkfhitgQiqFd5XZgCe
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:Enabled:rundll32" rundll32.exe -
Drops file in Drivers directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\bxvbda.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\blbdrive.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\cdrom.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\mssmbios.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\rdpencdd.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\usbprint.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\USBSTOR.SYS rundll32.exe File created C:\Windows\SysWOW64\drivers\amdide.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\fvevol.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\monitor.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\MSTEE.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\ndiswan.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\umbus.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\CompositeBus.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\intelppm.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\sffdisk.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\uliagpkx.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\tcpipreg.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\wanarp.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\aliide.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\modem.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\nsiproxy.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\stexstor.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\tdtcp.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\tunnel.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\ws2ifsl.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\adpu320.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\amdsbs.sys rundll32.exe File created C:\Windows\SysWOW64\Drivers\Brserid.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\cmdide.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\dmvsc.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\ql2300.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\sbp2port.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\amdxata.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\rdyboost.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\evbda.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\HTTP.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\nfrd960.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\rdprefmp.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\usbhub.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\volmgrx.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\WudfPf.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\circlass.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\intelide.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\lltdio.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\sermouse.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\viaide.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\iirsp.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\mshidkmdf.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\raspppoe.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\rdpbus.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\usbcir.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\vhdmp.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\hcw85cir.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\HidBatt.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\msiscsi.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\MegaSR.sys rundll32.exe File created C:\Windows\SysWOW64\DRIVERS\rasl2tp.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\amdsata.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\dxgkrnl.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\elxstor.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\hidbth.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\processr.sys rundll32.exe File created C:\Windows\SysWOW64\drivers\usbohci.sys rundll32.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000d000000012281-5.dat acprotect -
Deletes itself 1 IoCs
pid Process 2580 rundll32.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\mdhsh.sys rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\mdhsh.sys\ = "Driver" rundll32.exe -
Loads dropped DLL 5 IoCs
pid Process 2092 aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} rundll32.exe -
Modifies WinLogon 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhash aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhash\DllName = "mdhash.dll" aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhash\Startup = "mdhash" aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhash\Impersonate = "1" aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhash\Asynchronous = "1" aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhash\MaxWait = "1" aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhash\adr97 = "[89E62D4E3E1E15B68]" aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\CLFS.sys rundll32.exe File created C:\Windows\SysWOW64\mdhash.dll aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe File created C:\Windows\SysWOW64\mdhsh.sys aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe File opened for modification C:\Windows\SysWOW64\mdhsh.sys aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe File opened for modification C:\Windows\SysWOW64\idf.bin rundll32.exe -
resource yara_rule behavioral1/memory/2092-0-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/2092-7-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/files/0x000d000000012281-5.dat upx behavioral1/memory/2092-11-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2092-10-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/2580-17-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2580-19-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2580-18-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2580-20-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2580-229-0x0000000010000000-0x0000000010041000-memory.dmp upx behavioral1/memory/2580-231-0x0000000010000000-0x0000000010041000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 1740 2580 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4F3C-8081-5663EE0C6C49} rundll32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2580 rundll32.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe 2580 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2580 2092 aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe 30 PID 2092 wrote to memory of 2580 2092 aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe 30 PID 2092 wrote to memory of 2580 2092 aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe 30 PID 2092 wrote to memory of 2580 2092 aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe 30 PID 2092 wrote to memory of 2580 2092 aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe 30 PID 2092 wrote to memory of 2580 2092 aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe 30 PID 2092 wrote to memory of 2580 2092 aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe 30 PID 2580 wrote to memory of 1740 2580 rundll32.exe 32 PID 2580 wrote to memory of 1740 2580 rundll32.exe 32 PID 2580 wrote to memory of 1740 2580 rundll32.exe 32 PID 2580 wrote to memory of 1740 2580 rundll32.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe"C:\Users\Admin\AppData\Local\Temp\aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe mdhash.dll,mdhash C:\Users\Admin\AppData\Local\Temp\aa4fb5117829cc5db055647ef8a25e0c5cadef1032f5b6f84b600cb48d9b7912.exe2⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Deletes itself
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 7603⤵
- Program crash
PID:1740
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Browser Extensions
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5fa1af74ab17b5d7af7b56f46f09108f4
SHA15e98d7e2e2b59799bd6a05c4a7e9fab34bd883d2
SHA25686b7e650f323db5dcb5ccbaa43e84513871f7fbdb65d6314a386d09920cf5112
SHA51288ddeede18cf67f4e3f44cfe738a37f746f53417c0f475b9a525347e73dd02e637a915142d0cc04d01444f08eee2d28f0f42fda369bcc16cb956f894b9898f99
-
Filesize
21KB
MD574e66a253e1903eb5a7846d46ff534f9
SHA1538ce4817faf657f30fc91c9faaa33cbce9f04a3
SHA25617d466513173ae8a905996505a652b38d3fc5958d681663482f6c9e6245e7291
SHA512bb610538c1ece66ef0f891d810fa1de80d81cbc3fd173845f4aa0dd1a99bd83bc3a6de8563af845e813b445182d5f007e8f9d67940012239131155a107a6930b