bd7a026af2a04de3e4b8ab669f8314c0b2ac97e19be2ad26dc9c40411617a9c3

General

Target

27e24a57c19574993ff9a68bbb605010_JC.exe
Size

84KB
MD5

27e24a57c19574993ff9a68bbb605010
SHA1

2785b5a297e089e2696f3c4e866861806fb8520e
SHA256

bd7a026af2a04de3e4b8ab669f8314c0b2ac97e19be2ad26dc9c40411617a9c3
SHA512

2808ce749ed957c44c371a5b1b25c253750e8fc4000752da8ce41390c0dc631405d043bd761382f65adb5bd0cc59742534cdda0dfd80726a7325f8136a67fd44
SSDEEP

768:JgO5xRYi+SQvvG5bnl/NqNwsKVDsBYD77aXKynF0v:eshQvoLqNwDDhCe

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1596	rundll32.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	27e24a57c19574993ff9a68bbb605010_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	27e24a57c19574993ff9a68bbb605010_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	27e24a57c19574993ff9a68bbb605010_JC.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\¢«.exe	27e24a57c19574993ff9a68bbb605010_JC.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	27e24a57c19574993ff9a68bbb605010_JC.exe
File created	C:\Windows\SysWOW64\notepad¢¬.exe	27e24a57c19574993ff9a68bbb605010_JC.exe
File opened for modification	C:\Windows\SysWOW64\¢«.exe	27e24a57c19574993ff9a68bbb605010_JC.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\rundll32.exe	27e24a57c19574993ff9a68bbb605010_JC.exe
File created	C:\Windows\system\rundll32.exe	27e24a57c19574993ff9a68bbb605010_JC.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	1596	WerFault.exe	86

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	27e24a57c19574993ff9a68bbb605010_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	27e24a57c19574993ff9a68bbb605010_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	27e24a57c19574993ff9a68bbb605010_JC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1695147258"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	27e24a57c19574993ff9a68bbb605010_JC.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	27e24a57c19574993ff9a68bbb605010_JC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1695147258"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	27e24a57c19574993ff9a68bbb605010_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	27e24a57c19574993ff9a68bbb605010_JC.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
4580	27e24a57c19574993ff9a68bbb605010_JC.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4580	27e24a57c19574993ff9a68bbb605010_JC.exe
1596	rundll32.exe
1596	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 1596	4580	27e24a57c19574993ff9a68bbb605010_JC.exe	86
PID 4580 wrote to memory of 1596	4580	27e24a57c19574993ff9a68bbb605010_JC.exe	86
PID 4580 wrote to memory of 1596	4580	27e24a57c19574993ff9a68bbb605010_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\27e24a57c19574993ff9a68bbb605010_JC.exe
"C:\Users\Admin\AppData\Local\Temp\27e24a57c19574993ff9a68bbb605010_JC.exe"
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\system\rundll32.exe
  C:\Windows\system\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 1412
    3⤵
    - Program crash
    PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1596 -ip 1596
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\notepad¢¬.exe

Filesize
94KB

MD5
66fd62417fce7c9ef83364961706037b

SHA1
ed6bce6735ffbd26dd19808a6bb8dc11be60c0a9

SHA256
4b9a1ec9ec576a37238ddc025c75291c72f542d7289fc1fdf148b928d5c18c1c

SHA512
5314335b2ba47ac8b451bad8135265d84c93881d743afb448176d4452bcf4d8da549314e1a2b0cde6b150c331e6305ff89f4445de0a70054b438b2a2134d66d9

Download Submit
C:\Windows\System\rundll32.exe

Filesize
92KB

MD5
629c3f9ab6b471b8fc179139427b6380

SHA1
d96fdbd1bb8a5b57341389b3b983218109b61acc

SHA256
675a4376d252de6eddd354f5eaa40e145d07b00aeb3a6aaf7c3b0583d02fe7ae

SHA512
f27a83110242452de604516f2c33b44e05f722588e0b1696cc7461832d4e7c23dc21d5668795dfd79c3217e460f0b73c426876e22dd16a339a13ca6f084bdb38

Download Submit
C:\Windows\system\rundll32.exe

Filesize
92KB

MD5
629c3f9ab6b471b8fc179139427b6380

SHA1
d96fdbd1bb8a5b57341389b3b983218109b61acc

SHA256
675a4376d252de6eddd354f5eaa40e145d07b00aeb3a6aaf7c3b0583d02fe7ae

SHA512
f27a83110242452de604516f2c33b44e05f722588e0b1696cc7461832d4e7c23dc21d5668795dfd79c3217e460f0b73c426876e22dd16a339a13ca6f084bdb38

Download Submit
memory/1596-14-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1596-15-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4580-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4580-13-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads