Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2023, 07:23

General

  • Target

    067db9509152bfbd99d8e9e834d799bab91ae21526021e71385a6558c8e4e8fe.exe

  • Size

    83KB

  • MD5

    88665a6b6d117a5ee2e97435e04b8bec

  • SHA1

    ffd59d3d05dd5fc53ee16fb2539449976057d435

  • SHA256

    067db9509152bfbd99d8e9e834d799bab91ae21526021e71385a6558c8e4e8fe

  • SHA512

    4dd7b1c2bdc1ff7f62e391666ba2cd912aa32860c5de7f87d95a97081a509e8d7eaca39050c745f8347de5151836093efe0f2f24c406a10ea63fcb14c92e1e70

  • SSDEEP

    768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOc/:RshfSWHHNvoLqNwDDGw02eQmh0HjWOm

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\067db9509152bfbd99d8e9e834d799bab91ae21526021e71385a6558c8e4e8fe.exe
    "C:\Users\Admin\AppData\Local\Temp\067db9509152bfbd99d8e9e834d799bab91ae21526021e71385a6558c8e4e8fe.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    81KB

    MD5

    b0c2805ad470535efb14b7fb01358724

    SHA1

    d4f442ef1edd2f01bbe71d38f86bfc5bf1901ed1

    SHA256

    bb719a4fafd11c2a15efe95052f95c455fd451e5db9e48aad3ace34f2e525c35

    SHA512

    50dd469eabbc90ead00add2f548f0a02ce783b8d1d5c1a46e263a94976fd94395d433e4debb2e3a74ebaced1a5019c0ec522bfa277d7c8ddca6ed351230bbb45

  • C:\Windows\system\rundll32.exe

    Filesize

    79KB

    MD5

    b3ee1bd337d67bd25360a8fe9dc5a9d4

    SHA1

    eeda86294f328e45581dd2d5da61528af9607893

    SHA256

    477543ffb97054674500524e72a5a97d0eaa390cca7e1fb2ffe350388c0fcfd6

    SHA512

    44c2dcfda799ef249a55b9e16da1e3db3f11a95c996494565c7d7a71cdb6e728b8e47e372f6c787680f79ed169bc913920aebf5cc17a6d6bb45a3f3446fcdeee

  • C:\Windows\system\rundll32.exe

    Filesize

    79KB

    MD5

    b3ee1bd337d67bd25360a8fe9dc5a9d4

    SHA1

    eeda86294f328e45581dd2d5da61528af9607893

    SHA256

    477543ffb97054674500524e72a5a97d0eaa390cca7e1fb2ffe350388c0fcfd6

    SHA512

    44c2dcfda799ef249a55b9e16da1e3db3f11a95c996494565c7d7a71cdb6e728b8e47e372f6c787680f79ed169bc913920aebf5cc17a6d6bb45a3f3446fcdeee

  • \Windows\system\rundll32.exe

    Filesize

    79KB

    MD5

    b3ee1bd337d67bd25360a8fe9dc5a9d4

    SHA1

    eeda86294f328e45581dd2d5da61528af9607893

    SHA256

    477543ffb97054674500524e72a5a97d0eaa390cca7e1fb2ffe350388c0fcfd6

    SHA512

    44c2dcfda799ef249a55b9e16da1e3db3f11a95c996494565c7d7a71cdb6e728b8e47e372f6c787680f79ed169bc913920aebf5cc17a6d6bb45a3f3446fcdeee

  • \Windows\system\rundll32.exe

    Filesize

    79KB

    MD5

    b3ee1bd337d67bd25360a8fe9dc5a9d4

    SHA1

    eeda86294f328e45581dd2d5da61528af9607893

    SHA256

    477543ffb97054674500524e72a5a97d0eaa390cca7e1fb2ffe350388c0fcfd6

    SHA512

    44c2dcfda799ef249a55b9e16da1e3db3f11a95c996494565c7d7a71cdb6e728b8e47e372f6c787680f79ed169bc913920aebf5cc17a6d6bb45a3f3446fcdeee

  • memory/1300-21-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2484-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2484-12-0x0000000000380000-0x0000000000396000-memory.dmp

    Filesize

    88KB

  • memory/2484-20-0x0000000000380000-0x0000000000386000-memory.dmp

    Filesize

    24KB

  • memory/2484-19-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB