dc9588902281a3fda150d31af0e14c6bcd9e997ca2a25df68ae4068493aaa406

General

Target

24f4782e08e5bff9eea0fe507b968831.exe
Size

156KB
MD5

24f4782e08e5bff9eea0fe507b968831
SHA1

aa2b674dfcd565fbb93f328fda92c75d793dcd3e
SHA256

dc9588902281a3fda150d31af0e14c6bcd9e997ca2a25df68ae4068493aaa406
SHA512

dcd610f68794b59d4ac0e1b6627475d689aaa09aec8aeb2f82800de2f63c6f0d360508ccd72f8d53ff899e87aacb4d12b4ccbb6da7187db9f36b8c49e026c10d
SSDEEP

3072:fhfxHNIBdQmNitcrE4mzfOv9lH5ANJaYN2sn7ptdTP:f1piBdfitcrCDOzHWt2O

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3044	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
3020	24f4782e08e5bff9eea0fe507b968831.exe
3020	24f4782e08e5bff9eea0fe507b968831.exe

Modifies system executable filetype association 2 TTPs 3 IoCs

Modify Registry

Change Default File Association

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	24f4782e08e5bff9eea0fe507b968831.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	24f4782e08e5bff9eea0fe507b968831.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	24f4782e08e5bff9eea0fe507b968831.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\¢«.exe	24f4782e08e5bff9eea0fe507b968831.exe
File created	C:\Windows\SysWOW64\¢«.exe	24f4782e08e5bff9eea0fe507b968831.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	24f4782e08e5bff9eea0fe507b968831.exe
File created	C:\Windows\SysWOW64\notepad¢¬.exe	24f4782e08e5bff9eea0fe507b968831.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\rundll32.exe	24f4782e08e5bff9eea0fe507b968831.exe
File opened for modification	C:\Windows\system\rundll32.exe	24f4782e08e5bff9eea0fe507b968831.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	24f4782e08e5bff9eea0fe507b968831.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	24f4782e08e5bff9eea0fe507b968831.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	24f4782e08e5bff9eea0fe507b968831.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	24f4782e08e5bff9eea0fe507b968831.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	24f4782e08e5bff9eea0fe507b968831.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	24f4782e08e5bff9eea0fe507b968831.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	24f4782e08e5bff9eea0fe507b968831.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1704438022"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1704438022"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3020	24f4782e08e5bff9eea0fe507b968831.exe
3044	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3044	3020	24f4782e08e5bff9eea0fe507b968831.exe	28
PID 3020 wrote to memory of 3044	3020	24f4782e08e5bff9eea0fe507b968831.exe	28
PID 3020 wrote to memory of 3044	3020	24f4782e08e5bff9eea0fe507b968831.exe	28
PID 3020 wrote to memory of 3044	3020	24f4782e08e5bff9eea0fe507b968831.exe	28
PID 3020 wrote to memory of 3044	3020	24f4782e08e5bff9eea0fe507b968831.exe	28
PID 3020 wrote to memory of 3044	3020	24f4782e08e5bff9eea0fe507b968831.exe	28
PID 3020 wrote to memory of 3044	3020	24f4782e08e5bff9eea0fe507b968831.exe	28