Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2023 02:18

General

  • Target

    7e8f61d75b998928224e225033977304326695b030079f1d5a8870b9c94e5fbd.exe

  • Size

    84KB

  • MD5

    aa56d21e8739c84b47f440cb6e7ad600

  • SHA1

    4d252a2faff521992dacd2d9d8fd2cc5083873c1

  • SHA256

    7e8f61d75b998928224e225033977304326695b030079f1d5a8870b9c94e5fbd

  • SHA512

    9c447601762d2bbfa0f2c48030a645a0404f0d35dc781cfc14970f3b6c1b6714dd6c11eeff204ab09a75b37d12b3f1a132addd98518abe6f684a6e7f5301d136

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOMJpF:GhfxHNIreQm+HilJpF

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e8f61d75b998928224e225033977304326695b030079f1d5a8870b9c94e5fbd.exe
    "C:\Users\Admin\AppData\Local\Temp\7e8f61d75b998928224e225033977304326695b030079f1d5a8870b9c94e5fbd.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    74KB

    MD5

    272ac850cf3fc815807d69e2dce921f1

    SHA1

    7f5385a1beee3318bf3c064353f09d46fcc8106e

    SHA256

    143b5043ed68aecf96891c21d86b0a0c605e6696a88f59516a608dc8935ce7ef

    SHA512

    2a052752ae979fa3e53f2dae0d64b2e594de62dce5ae95385b7921bce4f2bd9413b2e064c31b0702f8437b3aca3b0072ac89981074bbcf3ee07e02d9630ef17b

  • C:\Windows\System\rundll32.exe

    Filesize

    77KB

    MD5

    b94bb26af2e317a52e61c194c40d4a65

    SHA1

    08ce80c943972b1c9a1e5ac1003e8d4ef8029aba

    SHA256

    013c9182b78679e4348c1d7b6b051e5a0ba8ce73f528dd831e241468026d730b

    SHA512

    14816b6c063719cc98c5fcdb3933ff531b496a2ed095c615544b3412f4fa07e8f06500f919e7de6684e5e1672a37945c2cdbd5887084bc64d8c9d763593f58c2

  • C:\Windows\system\rundll32.exe

    Filesize

    77KB

    MD5

    b94bb26af2e317a52e61c194c40d4a65

    SHA1

    08ce80c943972b1c9a1e5ac1003e8d4ef8029aba

    SHA256

    013c9182b78679e4348c1d7b6b051e5a0ba8ce73f528dd831e241468026d730b

    SHA512

    14816b6c063719cc98c5fcdb3933ff531b496a2ed095c615544b3412f4fa07e8f06500f919e7de6684e5e1672a37945c2cdbd5887084bc64d8c9d763593f58c2

  • memory/4540-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/4540-13-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/4656-14-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB