Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 03:32
Static task
static1
Behavioral task
behavioral1
Sample
36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe
Resource
win10v2004-20240508-en
General
-
Target
36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe
-
Size
83KB
-
MD5
b61a193bd0d0a490df14fa1f4747760a
-
SHA1
aaca3491a486d0a9c3afff430b5db2d8df8510b6
-
SHA256
36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd
-
SHA512
f974ed7bf700710020a2107d6e233c428a82cbcd1f8f1db5a740f12d40b744078786a33fc08a4e384aed28f491a6cc7a11b8694913a1679d14668d4d2a7f64d1
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOyO6JuQEM8+:GhfxHNIreQm+HiVO6JuQEM8+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32.exepid process 1948 rundll32.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
Processes:
rundll32.exe36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe -
Drops file in System32 directory 4 IoCs
Processes:
36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exedescription ioc process File opened for modification C:\Windows\SysWOW64\¢«.exe 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe File created C:\Windows\SysWOW64\¢«.exe 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe -
Drops file in Windows directory 2 IoCs
Processes:
36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exedescription ioc process File opened for modification C:\Windows\system\rundll32.exe 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe File created C:\Windows\system\rundll32.exe 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe -
Modifies registry class 15 IoCs
Processes:
36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exerundll32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1716521582" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1716521582" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exepid process 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 1948 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exerundll32.exepid process 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe 1948 rundll32.exe 1948 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exedescription pid process target process PID 3076 wrote to memory of 1948 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe rundll32.exe PID 3076 wrote to memory of 1948 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe rundll32.exe PID 3076 wrote to memory of 1948 3076 36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe"C:\Users\Admin\AppData\Local\Temp\36488a2365f331fcfb5fc83a989b4bcd9a33d1ba4190e89d474eceb2942fc2bd.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\notepad¢¬.exeFilesize
82KB
MD57bae4fc14d58daf7d63f556e8afa1ba9
SHA114f224f9bfa0ed48903d0613f6dfd8ceaeed73d2
SHA256b2a7ed17bd2577279575f3e97d6734ad726dc826bd6464b7b0ae77968cf9ad1e
SHA51213e902c7dcb1c805916c284289eadc66fd0036eb81c5ff57abf03f72ec2dddb095247bd47e499ef143461e47bf4a1aea8392548ad97bb67dbb6af31bd565a27c
-
C:\Windows\System\rundll32.exeFilesize
74KB
MD5f0253b750b4227812fa87cad2df0249e
SHA182299d7fd4d97b7d13d27a76a0adf0eb22933682
SHA2560d810caae2ef046479db8d707946a024163f7013ccb1e84fac1fb774d4fe718b
SHA51221b8cd7f9175ecb2d557abeb07b3ae3463487e3493c95f229d3fd9e71b1deee0b65a9ac245ee71976de21c9ae0bc957643f542b806cdb1abbe0908eba027be58
-
memory/3076-0-0x0000000000400000-0x0000000000415A00-memory.dmpFilesize
86KB
-
memory/3076-13-0x0000000000400000-0x0000000000415A00-memory.dmpFilesize
86KB