553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a

General

Target

553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
Size

84KB
MD5

4e7a41baa543d9d7d61444cfcbaa4b0d
SHA1

aa18030b1b006619332b62828c6c9ed38e12b805
SHA256

553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a
SHA512

654d89bf5ffd53178e6a506459ebc08a86ff21d7b1ef43c268f5ab0f08b1bcb0050e2f65d7600c2e618b946116c783644731b13b961932d09dfd93e6dd9e2917
SSDEEP

1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOncHN5SFS3ubM6P6u6w:GhfxHNIreQm+HiycHN5SFS3ubM6P6u6w

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4088	rundll32.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
File created	C:\Windows\SysWOW64\notepad¢¬.exe	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
File opened for modification	C:\Windows\SysWOW64\¢«.exe	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
File created	C:\Windows\SysWOW64\¢«.exe	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\rundll32.exe	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
File created	C:\Windows\system\rundll32.exe	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1697294842"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1697294842"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4088	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
4088	rundll32.exe
4088	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4088	4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe	87
PID 4584 wrote to memory of 4088	4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe	87
PID 4584 wrote to memory of 4088	4584	553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe	87

C:\Users\Admin\AppData\Local\Temp\553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe
"C:\Users\Admin\AppData\Local\Temp\553b1e35b7f9d99ea7d241e2438c428846d6c1bdb5a039675d67d3957ea4476a.exe"
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\system\rundll32.exe
  C:\Windows\system\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\notepad¢¬.exe

Filesize
85KB

MD5
aa5ca3302b2afaf36fcdfd0ee15190f2

SHA1
eca54fcd030d2f03b4b8a2ce3377c05c7bc6bba7

SHA256
0672b70b39d050636d545a3cbd7f18f68edb4136b8d1b8b6dc55ac445f20511f

SHA512
f9c817c223ab93b05f9af02565f0f266f0bbaa7f12e617d02ac6a276bb1b2d81076e5994e0b816f3643fe13c128cc5032f1f42e6d92d248c7db0fa3f4d424be0

Download Submit
C:\Windows\System\rundll32.exe

Filesize
85KB

MD5
7af89440792d06405cd254cf3aa22873

SHA1
71c27e9c6dcd11f89c1f4e9fca46b02fadfb1849

SHA256
41a54e03a1e9f737d1d0c5f36c307722a1ce973ba360e38c01cdfe4a29957926

SHA512
c3c29e69b19a0239bcf20f3dda674671961afc3b0d4756ae39ba437c9f51533da41527c050c88e4f35b0c89dc3f8e520e3748c07f4b7efaca12ab7abc586bf7e

Download Submit
C:\Windows\system\rundll32.exe

Filesize
85KB

MD5
7af89440792d06405cd254cf3aa22873

SHA1
71c27e9c6dcd11f89c1f4e9fca46b02fadfb1849

SHA256
41a54e03a1e9f737d1d0c5f36c307722a1ce973ba360e38c01cdfe4a29957926

SHA512
c3c29e69b19a0239bcf20f3dda674671961afc3b0d4756ae39ba437c9f51533da41527c050c88e4f35b0c89dc3f8e520e3748c07f4b7efaca12ab7abc586bf7e

Download Submit
memory/4088-14-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/4584-0-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/4584-13-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads