Overview
overview
10Static
static
10lab_sample...5b.exe
windows7-x64
6lab_sample...5b.exe
windows10-2004-x64
6lab_sample...82.exe
windows7-x64
8lab_sample...82.exe
windows10-2004-x64
8lab_sample...63.exe
windows7-x64
10lab_sample...63.exe
windows10-2004-x64
10lab_sample...15.exe
windows7-x64
3lab_sample...15.exe
windows10-2004-x64
3lab_sample...c7.exe
windows7-x64
3lab_sample...c7.exe
windows10-2004-x64
7lab_sample...fc.exe
windows7-x64
6lab_sample...fc.exe
windows10-2004-x64
6Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 23:24
Behavioral task
behavioral1
Sample
lab_samples/1e3966e77ad1cbf3e3ef76803fbf92300b2b88af39650a1208520e0cdc05645b.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
lab_samples/1e3966e77ad1cbf3e3ef76803fbf92300b2b88af39650a1208520e0cdc05645b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
lab_samples/6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
lab_samples/6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
lab_samples/6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
lab_samples/6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
lab_samples/a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
lab_samples/a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
lab_samples/b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
lab_samples/b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
lab_samples/e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
lab_samples/e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe
Resource
win10v2004-20241007-en
General
-
Target
lab_samples/6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe
-
Size
87KB
-
MD5
a579d53a1d29684de6d2c0cbabd525c5
-
SHA1
17661a04b4b150a6f70afdabe3fd9839cc56bee8
-
SHA256
6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82
-
SHA512
a98456792d7f7c83d0fe6be3ce6c48a4630a073b456848e0c8f614efe292a24fcf8d879ead5f2b418e5e29f46ae9356691383ba57e6066c5cacc0d47e675f817
-
SSDEEP
1536:PwjBg7Rj2r+65ofVkOu2avMtRsCtQqES1IVSJjXTmgacggNp:YjBY12G7uJvMnsGQhSYEmgacx
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 4 1056 rundll32.exe 5 1056 rundll32.exe 7 1056 rundll32.exe -
Loads dropped DLL 6 IoCs
pid Process 1056 rundll32.exe 1056 rundll32.exe 1056 rundll32.exe 1056 rundll32.exe 2936 WerFault.exe 2936 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CheckDone = "RunDll32.exe \"C:\\Windows\\System32\\api-ms-win-core-advapi-l1-1-0.dll\",init" rundll32.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\api-ms-win-core-advapi-l1-1-0.dll 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2936 1056 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1056 rundll32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2200 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 30 PID 2116 wrote to memory of 2200 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 30 PID 2116 wrote to memory of 2200 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 30 PID 2116 wrote to memory of 2200 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 30 PID 2116 wrote to memory of 2200 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 30 PID 2116 wrote to memory of 2200 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 30 PID 2116 wrote to memory of 2200 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 30 PID 2116 wrote to memory of 1056 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 31 PID 2116 wrote to memory of 1056 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 31 PID 2116 wrote to memory of 1056 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 31 PID 2116 wrote to memory of 1056 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 31 PID 2116 wrote to memory of 1056 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 31 PID 2116 wrote to memory of 1056 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 31 PID 2116 wrote to memory of 1056 2116 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe 31 PID 1056 wrote to memory of 2936 1056 rundll32.exe 32 PID 1056 wrote to memory of 2936 1056 rundll32.exe 32 PID 1056 wrote to memory of 2936 1056 rundll32.exe 32 PID 1056 wrote to memory of 2936 1056 rundll32.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\lab_samples\6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe"C:\Users\Admin\AppData\Local\Temp\lab_samples\6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" javascript:"\..\mshtml,RunHTMLApplication ";document.write("\74script language=javascript>"+(new%20ActiveXObject("WScript.Shell")).RegWrite("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CheckDone","RunDll32.exe%20\"C:\\Windows\\System32\\api-ms-win-core-advapi-l1-1-0.dll\",init","REG_SZ")+"\74/script>")2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2200
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-advapi-l1-1-0.dll",init2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 7963⤵
- Loads dropped DLL
- Program crash
PID:2936
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD575f71713a429589e87cf2656107d2bfc
SHA1f7608ef62a45822e9300d390064e667028b75dea
SHA256b6fff95a74f9847f1a4282b38f148d80e4684d9c35d9ae79fad813d5dc0fd7a9
SHA512cfadd55e93f00a91e9c6c3804725aa85e65e76039ec6021607ce7bb5dd30369329aae7cd11344c703094090e1f9be513988703f9a4cb8b2223464254a9104b93