Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 05:17

General

  • Target

    5510219bd5e48f7e36d15616bc1ae48096defb97df79944f7d6fafbf31e48742.exe

  • Size

    84KB

  • MD5

    7ee390f5e7b0cfb7c8c642f66c91a7c0

  • SHA1

    4b3536ff664593ab504f9827dac835dc78b57784

  • SHA256

    5510219bd5e48f7e36d15616bc1ae48096defb97df79944f7d6fafbf31e48742

  • SHA512

    de70aa0f143446219a3c96e73f294b0e88751f6201111191a52ef4f931771ff63aec6f9253e286af40ae9a787d71f7d59d60157a2c4b2f23c914e385dc6dc4ee

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWONOfNpKx4:GhfxHNIreQm+HiwOfNpKx4

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5510219bd5e48f7e36d15616bc1ae48096defb97df79944f7d6fafbf31e48742.exe
    "C:\Users\Admin\AppData\Local\Temp\5510219bd5e48f7e36d15616bc1ae48096defb97df79944f7d6fafbf31e48742.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:464
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    75KB

    MD5

    79b4cf6b52573b2c31d331f9e17c7b42

    SHA1

    03cee5200d05345af54a34a14543c248548f360c

    SHA256

    6ea740ef9d10e7a139982dbcddb7e7336d42794800003269aadc517f7285c63f

    SHA512

    bf228009cfdb15660aea0ef0368e838ece6642490e30513ecd664a1e53c41bcd206b555f91c70b0d6f78b5ce98a46a867b9c737feb649ee2f26372978c5106e5

  • C:\Windows\System\rundll32.exe

    Filesize

    76KB

    MD5

    52b65a450fc5fdd324c30d035656e3f4

    SHA1

    2004626aab1c0335370f62b4ecc8cec1b0078bfc

    SHA256

    cffa3924e95d8b0bb20e63ed26f672481354ad69c16915828258cde644d38b7a

    SHA512

    a9c284486438ebe1ec7a355aadc1d9b0388e2cbd11cdaaf1aa9ff306a4b832b471e0c11549a021e8802c346d42a01a4e922a2c3b3aa5e7b48ac8e4db462f5709

  • memory/464-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/464-13-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB