Overview
overview
10Static
static
10lab_sample...5b.exe
windows7-x64
7lab_sample...5b.exe
windows10-2004-x64
7lab_sample...82.exe
windows7-x64
8lab_sample...82.exe
windows10-2004-x64
7lab_sample...63.exe
windows7-x64
10lab_sample...63.exe
windows10-2004-x64
10lab_sample...15.exe
windows7-x64
1lab_sample...15.exe
windows10-2004-x64
1lab_sample...c7.exe
windows7-x64
3lab_sample...c7.exe
windows10-2004-x64
7lab_sample...fc.exe
windows7-x64
6lab_sample...fc.exe
windows10-2004-x64
6Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 11:50
Behavioral task
behavioral1
Sample
lab_samples/1e3966e77ad1cbf3e3ef76803fbf92300b2b88af39650a1208520e0cdc05645b.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
lab_samples/1e3966e77ad1cbf3e3ef76803fbf92300b2b88af39650a1208520e0cdc05645b.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
lab_samples/6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
lab_samples/6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
lab_samples/6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
lab_samples/6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
lab_samples/a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
lab_samples/a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
lab_samples/b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
lab_samples/b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
lab_samples/e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
lab_samples/e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe
Resource
win10v2004-20240508-en
General
-
Target
lab_samples/6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe
-
Size
87KB
-
MD5
a579d53a1d29684de6d2c0cbabd525c5
-
SHA1
17661a04b4b150a6f70afdabe3fd9839cc56bee8
-
SHA256
6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82
-
SHA512
a98456792d7f7c83d0fe6be3ce6c48a4630a073b456848e0c8f614efe292a24fcf8d879ead5f2b418e5e29f46ae9356691383ba57e6066c5cacc0d47e675f817
-
SSDEEP
1536:PwjBg7Rj2r+65ofVkOu2avMtRsCtQqES1IVSJjXTmgacggNp:YjBY12G7uJvMnsGQhSYEmgacx
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exeflow pid process 4 1916 rundll32.exe 5 1916 rundll32.exe 7 1916 rundll32.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exeWerFault.exepid process 1916 rundll32.exe 1916 rundll32.exe 1916 rundll32.exe 1916 rundll32.exe 2608 WerFault.exe 2608 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CheckDone = "RunDll32.exe \"C:\\Windows\\System32\\api-ms-win-core-advapi-l1-1-0.dll\",init" rundll32.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exedescription ioc process File created C:\Windows\SysWOW64\api-ms-win-core-advapi-l1-1-0.dll 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2608 1916 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 1916 rundll32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exerundll32.exedescription pid process target process PID 2180 wrote to memory of 1704 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1704 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1704 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1704 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1704 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1704 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1704 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1916 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1916 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1916 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1916 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1916 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1916 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 2180 wrote to memory of 1916 2180 6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe rundll32.exe PID 1916 wrote to memory of 2608 1916 rundll32.exe WerFault.exe PID 1916 wrote to memory of 2608 1916 rundll32.exe WerFault.exe PID 1916 wrote to memory of 2608 1916 rundll32.exe WerFault.exe PID 1916 wrote to memory of 2608 1916 rundll32.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\lab_samples\6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe"C:\Users\Admin\AppData\Local\Temp\lab_samples\6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" javascript:"\..\mshtml,RunHTMLApplication ";document.write("\74script language=javascript>"+(new%20ActiveXObject("WScript.Shell")).RegWrite("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CheckDone","RunDll32.exe%20\"C:\\Windows\\System32\\api-ms-win-core-advapi-l1-1-0.dll\",init","REG_SZ")+"\74/script>")2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-advapi-l1-1-0.dll",init2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 8003⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-advapi-l1-1-0.dllFilesize
36KB
MD575f71713a429589e87cf2656107d2bfc
SHA1f7608ef62a45822e9300d390064e667028b75dea
SHA256b6fff95a74f9847f1a4282b38f148d80e4684d9c35d9ae79fad813d5dc0fd7a9
SHA512cfadd55e93f00a91e9c6c3804725aa85e65e76039ec6021607ce7bb5dd30369329aae7cd11344c703094090e1f9be513988703f9a4cb8b2223464254a9104b93