Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2023 18:26
Static task
static1
Behavioral task
behavioral1
Sample
3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe
Resource
win10v2004-20231023-en
General
-
Target
3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe
-
Size
78KB
-
MD5
933e75d6eb417732688285a3b5e67eff
-
SHA1
f951e48c80b582c0147f75aeb03ba34ba2972774
-
SHA256
3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b
-
SHA512
f3ce70f80f91fdbd76b4fd8d3580074219821825ecf6964bec793654e0410e0df85a8e35cbb4e55d5892de8b63545fdf280145409e2f8cdb5059ad920ee44619
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOTuEWfp:GhfxHNIreQm+HiQuEWR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1540 rundll32.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe File created C:\Windows\SysWOW64\¢«.exe 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe File created C:\Windows\system\rundll32.exe 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1698690417" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1698690417" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1540 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 1540 rundll32.exe 1540 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4480 wrote to memory of 1540 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 90 PID 4480 wrote to memory of 1540 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 90 PID 4480 wrote to memory of 1540 4480 3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe"C:\Users\Admin\AppData\Local\Temp\3d69d1fa8c64ee6976d69fe6e6217739ffe449cbaf230dafb5acfe7fc916a70b.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD537f1e390a97ee13aa3055d1ea6703c0b
SHA1140eea819c42634e343b0554e7616ad63f25225b
SHA2569f7c1cec0d8b56d5ca6303420059300a9a44aaba3f126a91865d6b8076dc17da
SHA51272bcaf7971a4b863e06ec610eccffdff54be4140b083bf924387293b0e118c37e7214806b696441a5b4c5cbd884fb0205b41e9040864f3ba03c58645866943ef
-
Filesize
79KB
MD50eb30e98cd0dbaf9b778c8a9eebf18d4
SHA1706bd80c5f6984d3de7fbf7767aec35c715d5b08
SHA256789616e12cf9b7bcf5e4916d3d44e37316769711160698588c4f6aab2d1e2d29
SHA512387a9afe155e73b4bb1fcb2ffc2b7854f1f85b516c06a96d76698a7f81e7f2d40390d3330d38c3e0dc56e8884bad8886a29eb51d47ec1713da4a9dd245c10467
-
Filesize
79KB
MD50eb30e98cd0dbaf9b778c8a9eebf18d4
SHA1706bd80c5f6984d3de7fbf7767aec35c715d5b08
SHA256789616e12cf9b7bcf5e4916d3d44e37316769711160698588c4f6aab2d1e2d29
SHA512387a9afe155e73b4bb1fcb2ffc2b7854f1f85b516c06a96d76698a7f81e7f2d40390d3330d38c3e0dc56e8884bad8886a29eb51d47ec1713da4a9dd245c10467