bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9

General

Target

bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
Size

82KB
MD5

28cb535e070b8a5eac6885ed2ad693e9
SHA1

d6959ddf71c7dc6d4a6becad7280693c8692f393
SHA256

bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9
SHA512

137a6a4f8a3920f5683690cb25390f0c25e12da533215e00bfc6c10e992a7d807945749a217bce2b6874d26c038909c052bb0522d2c9441eb36a4a0bfd802cea
SSDEEP

1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOYAlB75:GhfxHNIreQm+Hi1AlB75

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4068	rundll32.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\notepad¢¬.exe	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
File opened for modification	C:\Windows\SysWOW64\¢«.exe	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
File created	C:\Windows\SysWOW64\¢«.exe	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\rundll32.exe	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
File created	C:\Windows\system\rundll32.exe	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1716322675"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1716322675"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4068	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
4068	rundll32.exe
4068	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4068	4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe	88
PID 4088 wrote to memory of 4068	4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe	88
PID 4088 wrote to memory of 4068	4088	bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe	88

C:\Users\Admin\AppData\Local\Temp\bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe
"C:\Users\Admin\AppData\Local\Temp\bd2ec252249b933eb8017ccac34efed4ff4337038ca87c9b14cca9fdf73210c9.exe"
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\system\rundll32.exe
  C:\Windows\system\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\notepad¢¬.exe

Filesize
84KB

MD5
3283cec35811c6892f0b6b8a6c0adb2e

SHA1
1506231c30015d343cdf4979c74241996abddc13

SHA256
92977e5c1149ffce77a3e269aeebae4ef3a9629aa25ee035d4f8bcfbed8e3f02

SHA512
62974f854c47c68f9f0a2ce202119694a29faf149764effe372cf168395d82035c07b00f3b36bb79393bc3c7e49495aa15112f0349069a22b3ce45b2dda3214e

Download Submit
C:\Windows\System\rundll32.exe

Filesize
74KB

MD5
23b3209a604dddd04a3a9099f8661484

SHA1
647bdd0250ba40001048db759f118c2234deb031

SHA256
00cabd90dc06c7429c22343deef8b6af43b0e681148a4850dd5677fe4edbe480

SHA512
55178479aacc14e1e45b42df8947c5b7d00c78b688075dd156b23083c2f034b2e286e2fbfde857e40b0230077e245e828a18b4b71333911d0af95712cfd704f9

Download Submit
memory/4088-0-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/4088-13-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads