Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 19:51
Static task
static1
Behavioral task
behavioral1
Sample
1291e42002f2573e1ffc21e13697e8a7b2173d2097be645369e52e949a7ae834.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1291e42002f2573e1ffc21e13697e8a7b2173d2097be645369e52e949a7ae834.dll
Resource
win10v2004-20241007-en
General
-
Target
1291e42002f2573e1ffc21e13697e8a7b2173d2097be645369e52e949a7ae834.dll
-
Size
339KB
-
MD5
3bf48991916fef2d1512ba81a750765a
-
SHA1
8283110fc75fff23697941b8019edc6e1ea2e673
-
SHA256
1291e42002f2573e1ffc21e13697e8a7b2173d2097be645369e52e949a7ae834
-
SHA512
aefbb6737371f1e51d1482138ba219040e310d42047c0b8492ff0d8429838ffca1793c9f1cf80b212aa671c6d87317c64638eb75487437ae33f4fee43cb06c5b
-
SSDEEP
6144:xJ7D5RtYutKWXfsMWxbsFMTk8YnpjAycXdBkB:PbtYapX0yrXB
Malware Config
Signatures
-
Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs
Processes:
rundll32.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler\{EA72FA62-FC84-B73F-C850-52EA61E951D9} rundll32.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
rundll32.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{851C940C-A62E-51D9-62FA-0C840B830B73} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{851C940C-A62E-51D9-62FA-0C840B830B73}\ rundll32.exe -
Drops file in System32 directory 4 IoCs
Processes:
rundll32.exedescription ioc Process File created C:\Windows\SysWOW64\OSX.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\OSX.dll rundll32.exe File created C:\Windows\SysWOW64\INR.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\INR.dll rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 10 IoCs
Processes:
rundll32.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851C940C-A62E-51D9-62FA-0C840B830B73}\ rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851C940C-A62E-51D9-62FA-0C840B830B73}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA72FA62-FC84-B73F-C850-52EA61E951D9}\ rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA72FA62-FC84-B73F-C850-52EA61E951D9}\InprocServer32\ = "C:\\Windows\\SysWow64\\OSX.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851C940C-A62E-51D9-62FA-0C840B830B73} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851C940C-A62E-51D9-62FA-0C840B830B73}\InprocServer32\ = "C:\\Windows\\SysWow64\\INR.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA72FA62-FC84-B73F-C850-52EA61E951D9} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA72FA62-FC84-B73F-C850-52EA61E951D9}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EA72FA62-FC84-B73F-C850-52EA61E951D9}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851C940C-A62E-51D9-62FA-0C840B830B73}\InprocServer32 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 1916 wrote to memory of 1996 1916 rundll32.exe 31 PID 1916 wrote to memory of 1996 1916 rundll32.exe 31 PID 1916 wrote to memory of 1996 1916 rundll32.exe 31 PID 1916 wrote to memory of 1996 1916 rundll32.exe 31 PID 1916 wrote to memory of 1996 1916 rundll32.exe 31 PID 1916 wrote to memory of 1996 1916 rundll32.exe 31 PID 1916 wrote to memory of 1996 1916 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1291e42002f2573e1ffc21e13697e8a7b2173d2097be645369e52e949a7ae834.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1291e42002f2573e1ffc21e13697e8a7b2173d2097be645369e52e949a7ae834.dll,#12⤵
- Modifies Shared Task Scheduler registry keys
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
339KB
MD502ed38b790361fc900eccfecaabdc632
SHA133a29f34d59fec86d9ecacd9e86dfe8229a34683
SHA256d2101c6d5769cadc72cf03430722caa4dff8e3e7e8507027a31f3104266a407b
SHA512ad9cddb043f52827ce7100298cfcf830c52ec703ffa062193efce522d8b0d37afe39d2da4804902235685b8470e57259eb2f99ee42790c7fe64bce3800ff1208