3526c74a22a6a7ff285bddc4a055d22e443bd2d9ceb47aa7bc20240256084787 | Triage

Analysis

max time kernel
1800s
max time network
1570s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 13:44

Sharing

Report Analysis Logs

General

Target

genenenrnenr.exe
Size

808KB
MD5

e49c40f6a69af400f2e11dd8fe6604dd
SHA1

56107d38cc5a94c67bdb92aa7566768b8e82b1f2
SHA256

b4c2ffccfe807167860d70ea95cde0390f2dc4220992d272497ced04afb97edd
SHA512

80f782bf58a405559a1140be30838b7d46ddca5423d9001cb1f87005e0e46e2a6e20ae3229bd095e86d8f2fbc30020a7be8f08c7f47f095247168424b2412e28
SSDEEP

12288:oTsKNGpaBPxBlvdtsYuj+Ue8vQjY7heDHcMicoXfC/ye:YNG+PxvU3tvQweDHydqJ

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

Processes:

genenenrnenr.exe

description	ioc	process
File created	C:\Windows\SysWOW64\kernel32.dlI	genenenrnenr.exe
File opened for modification	C:\Windows\SysWOW64\kernel32.dlI	genenenrnenr.exe

Modifies registry class 7 IoCs

Processes:

genenenrnenr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dlIfile\shell\open	genenenrnenr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dlIfile\shell\open\command\ = "%1"	genenenrnenr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dlI	genenenrnenr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dlI\ = "dlIfile"	genenenrnenr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dlIfile\shell\open\command	genenenrnenr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dlIfile	genenenrnenr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\dlIfile\shell	genenenrnenr.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

genenenrnenr.exe

pid process

2940 genenenrnenr.exe

C:\Users\Admin\AppData\Local\Temp\genenenrnenr.exe
"C:\Users\Admin\AppData\Local\Temp\genenenrnenr.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2940

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2940-2-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/2940-4-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download