Analysis

  • max time kernel
    164s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 17:31

General

  • Target

    6710637ca908c879df671a16402efea03b8631acc48b1424c2205c6afb77059c.exe

  • Size

    77KB

  • MD5

    ec0fd03a2c2ea4bdd9d4a22958b62984

  • SHA1

    0110e76cbd3caf0fb4783947d82387a3ca592f98

  • SHA256

    6710637ca908c879df671a16402efea03b8631acc48b1424c2205c6afb77059c

  • SHA512

    ade2f134daa3d0079847fee7f1ccb4748f65e6d60e25dfb4977997d459acd11030e02413de05eed5fc89a69e955ab7aaf15d70025779e066f8d5fd3e5dad0b49

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOK3b:GhfxHNIreQm+Hir3b

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6710637ca908c879df671a16402efea03b8631acc48b1424c2205c6afb77059c.exe
    "C:\Users\Admin\AppData\Local\Temp\6710637ca908c879df671a16402efea03b8631acc48b1424c2205c6afb77059c.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    75KB

    MD5

    bde1c5c3b8dfb0f31447c196a750fec9

    SHA1

    4035d962df5b1ec851d2968c3e8d10727c04378b

    SHA256

    1b8f41cd8a0e31f5c79e632f3073ac5c5c09765b5a873e0a3b565f9e35d775bd

    SHA512

    d44fc0ad50e211482ee8e42d70733da61eea9a4b924b10caead2a733d6800c77a7f6cc07dab15c6aa914f75e6a9c09033e64b5c69e841760bfea04fad30fda22

  • C:\Windows\system\rundll32.exe

    Filesize

    77KB

    MD5

    ac1fb871475559dd97a55cb3b8b835d9

    SHA1

    95462c6ca703e44747e2cafa9bff62f64ba9d105

    SHA256

    00406cec6a5e480e88101e8956d73dce009db10bda833dd7cc6d5dcd87d39cc5

    SHA512

    50a2bf738e24fc96a333e0142ba96b974dd81089afca74ecb2c05012bf84534e10ced91a7c279e484c6b09b62adcbb9713a520e97509a1c811ac6fbd70ed17f7

  • C:\Windows\system\rundll32.exe

    Filesize

    77KB

    MD5

    ac1fb871475559dd97a55cb3b8b835d9

    SHA1

    95462c6ca703e44747e2cafa9bff62f64ba9d105

    SHA256

    00406cec6a5e480e88101e8956d73dce009db10bda833dd7cc6d5dcd87d39cc5

    SHA512

    50a2bf738e24fc96a333e0142ba96b974dd81089afca74ecb2c05012bf84534e10ced91a7c279e484c6b09b62adcbb9713a520e97509a1c811ac6fbd70ed17f7

  • \Windows\system\rundll32.exe

    Filesize

    77KB

    MD5

    ac1fb871475559dd97a55cb3b8b835d9

    SHA1

    95462c6ca703e44747e2cafa9bff62f64ba9d105

    SHA256

    00406cec6a5e480e88101e8956d73dce009db10bda833dd7cc6d5dcd87d39cc5

    SHA512

    50a2bf738e24fc96a333e0142ba96b974dd81089afca74ecb2c05012bf84534e10ced91a7c279e484c6b09b62adcbb9713a520e97509a1c811ac6fbd70ed17f7

  • \Windows\system\rundll32.exe

    Filesize

    77KB

    MD5

    ac1fb871475559dd97a55cb3b8b835d9

    SHA1

    95462c6ca703e44747e2cafa9bff62f64ba9d105

    SHA256

    00406cec6a5e480e88101e8956d73dce009db10bda833dd7cc6d5dcd87d39cc5

    SHA512

    50a2bf738e24fc96a333e0142ba96b974dd81089afca74ecb2c05012bf84534e10ced91a7c279e484c6b09b62adcbb9713a520e97509a1c811ac6fbd70ed17f7

  • memory/2308-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2308-11-0x0000000000380000-0x0000000000396000-memory.dmp

    Filesize

    88KB

  • memory/2308-20-0x0000000000380000-0x0000000000396000-memory.dmp

    Filesize

    88KB

  • memory/2308-23-0x0000000000380000-0x0000000000386000-memory.dmp

    Filesize

    24KB

  • memory/2308-22-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2560-21-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2560-24-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB