d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966

General

Target

d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
Size

73KB
MD5

808345ec6e4849362d3ea938066f2d45
SHA1

e466577521b4678a7a341bbb27f9ddaf5114b8a3
SHA256

d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966
SHA512

200b76467b23cb00972cdc14be338121776c2d49e6cb338cb034362d78976bf08426e8ef426c913093af2b2db9d5b6acae9df3c7f9b3cc32e11a9e158dbaec1c
SSDEEP

768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO:RshfSWHHNvoLqNwDDGw02eQmh0HjWO

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4868	rundll32.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\¢«.exe	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
File created	C:\Windows\SysWOW64\¢«.exe	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
File created	C:\Windows\SysWOW64\notepad¢¬.exe	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\rundll32.exe	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
File created	C:\Windows\system\rundll32.exe	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1697042889"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1697042889"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
4868	rundll32.exe
4868	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4868	4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe	89
PID 4892 wrote to memory of 4868	4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe	89
PID 4892 wrote to memory of 4868	4892	d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe	89

C:\Users\Admin\AppData\Local\Temp\d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe
"C:\Users\Admin\AppData\Local\Temp\d5ed71cd6ceeffaff8636a9988466f3cc2561d1a2905ed4be5bd0894957ac966.exe"
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\system\rundll32.exe
  C:\Windows\system\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\notepad¢¬.exe

Filesize
81KB

MD5
b8a7c6816c5fd4e1fb48c38b37e947e0

SHA1
c76e8b1afebfa47cbafcdfa20a02b9611acf6526

SHA256
ff7dd5fa30664e3a4500045b46d0d61b1a4fce3a80cf8f13b5b3898265d6f8f0

SHA512
6e089aa1b98ff4b1d1dc732b61bf4507b8032922cc6f9491a9e75c3fe304ffe7c65e2e911c53946006574baa80fdb1ebde5c6eada03c8262971ed26c96da1d5a

Download Submit
C:\Windows\System\rundll32.exe

Filesize
83KB

MD5
e919ea76bfcde518f9c2de9d9ec21dd9

SHA1
470326e9f21b7b259f4a216be8029eaa25579e5b

SHA256
9a97c7374fef7f10a67de649cab57ab067f4a77a1fe849832ac636ba1207aa23

SHA512
46d4c9d9d6d624ebf8e0d69ca96e56b1324b102d44bef49d61835c19acb6d2ba38beb438b4faebb9ff4e1a940467ad8533961e63936cf451a0f5894ecfee0c9d

Download Submit
C:\Windows\system\rundll32.exe

Filesize
83KB

MD5
e919ea76bfcde518f9c2de9d9ec21dd9

SHA1
470326e9f21b7b259f4a216be8029eaa25579e5b

SHA256
9a97c7374fef7f10a67de649cab57ab067f4a77a1fe849832ac636ba1207aa23

SHA512
46d4c9d9d6d624ebf8e0d69ca96e56b1324b102d44bef49d61835c19acb6d2ba38beb438b4faebb9ff4e1a940467ad8533961e63936cf451a0f5894ecfee0c9d

Download Submit
memory/4892-0-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/4892-13-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads