Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

PtBIxmYbK8.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

initial sample

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_7d3365b34093db6d884642e334bbbe4e6283fce_7cac0383_0272cd40\Report.wer

Little-endian UTF-16 Unicode text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5DF2.tmp.csv

data

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER62D5.tmp.txt

data

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBA15.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Jan 15 04:03:58 2022, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC08F.tmp.WERInternalMetadata.xml

XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC533.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Microsoft Cabinet archive data, 61414 bytes, 1 file

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

data

modified

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Little-endian UTF-16 Unicode text, with CRLF, CR line terminators

modified

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

MS Windows registry file, NT/2000 or above

dropped

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_7d3365b34093db6d884642e334bbbe4e6283fce_7cac0383_08b56415\Report.wer

Little-endian UTF-16 Unicode text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1607.tmp.csv

data

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FFB.tmp.txt

data

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4CA5.tmp.dmp

Mini DuMP crash report, 15 streams, Sat Jan 15 03:47:54 2022, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER52DF.tmp.WERInternalMetadata.xml

XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER57F1.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

There are 8 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Windows\System32\svchost.exe

c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc

C:\Windows\System32\loaddll32.exe

loaddll32.exe "C:\Users\user\Desktop\PtBIxmYbK8.dll"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C rundll32.exe "C:\Users\user\Desktop\PtBIxmYbK8.dll",#1

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe /s C:\Users\user\Desktop\PtBIxmYbK8.dll

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Users\user\Desktop\PtBIxmYbK8.dll",#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\user\Desktop\PtBIxmYbK8.dll,DllRegisterServer

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\PtBIxmYbK8.dll",DllRegisterServer

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\PtBIxmYbK8.dll",DllRegisterServer

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mjuakgeb\fhtvflqppfnv.wdg",DvMDRtCzK

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Mjuakgeb\fhtvflqppfnv.wdg",DllRegisterServer

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Nvtcylmbo\muiecmoc.icg",BOAeVPaP

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Nvtcylmbo\muiecmoc.icg",DllRegisterServer

C:\Windows\System32\SgrmBroker.exe

C:\Windows\system32\SgrmBroker.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6048 -ip 6048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 512

C:\Program Files\Windows Defender\MpCmdRun.exe

"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5048 -ip 5048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 516

There are 14 hidden processes, click here to show them.

URLs

Name

Malicious

https://www.disneyplus.com/legal/your-california-privacy-rights

unknown

Details

Name:	https://www.disneyplus.com/legal/your-california-privacy-rights
TargetID:	26
From Memory:	true
Current Path:	C:\Windows\System32\svchost.exe
Source:	svchost.exe, 0000001A.00000003.441248860.0000023177791000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.443775997.0000023177777000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441382268.00000231777B1000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441129492.000002317776C000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441267741.000002317776D000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441353106.00000231777D1000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441319649.000002317779B000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441399080.0000023177C02000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441299535.000002317777F000.00000004.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://crl.ver)

unknown

Details

Name:	http://crl.ver)
TargetID:	26
From Memory:	true
Current Path:	C:\Windows\System32\svchost.exe
Source:	svchost.exe, 0000001A.00000002.472481866.0000023176EE7000.00000004.00000001.sdmp
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://www.disneyplus.com/legal/privacy-policy

unknown

Details

Name:	https://www.disneyplus.com/legal/privacy-policy
TargetID:	26
From Memory:	true
Current Path:	C:\Windows\System32\svchost.exe
Source:	svchost.exe, 0000001A.00000003.441248860.0000023177791000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.443775997.0000023177777000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441382268.00000231777B1000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441129492.000002317776C000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441267741.000002317776D000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441353106.00000231777D1000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441319649.000002317779B000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441399080.0000023177C02000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441299535.000002317777F000.00000004.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://upx.sf.net

unknown

Details

Name:	http://upx.sf.net
TargetID:	13
From Memory:	true
Current Path:	C:\Windows\SysWOW64\WerFault.exe
Source:	Amcache.hve.13.dr
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://www.tiktok.com/legal/report/feedback

unknown

Details

Name:	https://www.tiktok.com/legal/report/feedback
TargetID:	26
From Memory:	true
Current Path:	C:\Windows\System32\svchost.exe
Source:	svchost.exe, 0000001A.00000003.445321406.000002317777F000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.446551226.000002317777F000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.446523607.0000023177C02000.00000004.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://help.disneyplus.com.

unknown

Details

Name:	http://help.disneyplus.com.
TargetID:	26
From Memory:	true
Current Path:	C:\Windows\System32\svchost.exe
Source:	svchost.exe, 0000001A.00000003.441248860.0000023177791000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.443775997.0000023177777000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441382268.00000231777B1000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441129492.000002317776C000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441267741.000002317776D000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441353106.00000231777D1000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441319649.000002317779B000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441399080.0000023177C02000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.441299535.000002317777F000.00000004.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.microft8

unknown

Details

Name:	http://schemas.microft8
TargetID:	26
From Memory:	true
Current Path:	C:\Windows\System32\svchost.exe
Source:	svchost.exe, 0000001A.00000002.472756328.000002317771F000.00000004.00000001.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://disneyplus.com/legal.

unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report

Files

Processes

URLs