634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97

General

Target

634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
Size

84KB
MD5

5f8f8a3745da64221d702edc2f68909f
SHA1

7b6eda264c737364fb7b19295817f1f2eaf0be43
SHA256

634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97
SHA512

b3c398f2d17ab931c6321e49d539d39420ac4f67a2f6632755941f537b0a94a4a2f8a751e3997903acc757be3d94238d7812962f1a52297a2fba6ff17e8c443f
SSDEEP

1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOecBHZLcCi:GhfxHNIreQm+HitcBHZLcCi

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2292	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\notepad¢¬.exe	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
File opened for modification	C:\Windows\SysWOW64\¢«.exe	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
File created	C:\Windows\SysWOW64\¢«.exe	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\rundll32.exe	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
File created	C:\Windows\system\rundll32.exe	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1716541393"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1716541393"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2292	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
2292	rundll32.exe
2292	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2292	1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe	28
PID 1996 wrote to memory of 2292	1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe	28
PID 1996 wrote to memory of 2292	1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe	28
PID 1996 wrote to memory of 2292	1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe	28
PID 1996 wrote to memory of 2292	1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe	28
PID 1996 wrote to memory of 2292	1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe	28
PID 1996 wrote to memory of 2292	1996	634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe	28

C:\Users\Admin\AppData\Local\Temp\634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe
"C:\Users\Admin\AppData\Local\Temp\634c1ff5ab9165343d21b4f8acdd2edddc50aa7cd4b5435e72730528122e5a97.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system\rundll32.exe
  C:\Windows\system\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\notepad¢¬.exe

Filesize
82KB

MD5
595ec8ae0a585b2da08d5c90c7927bc1

SHA1
be24a07806627d578b4616a174d6e1fab16fa7da

SHA256
576e91a1d1a58097393ff3f65dc4223dd2e47a2d2be7057fab6eb388dd819ab8

SHA512
de125cf9969ada3f2d4d31844913e816de36a205744b6f7121abe2d019e4708138b5f8f0d9e004b9859a4a4fa597c439aab332330a329ba47833b88bd5e30150

Download Submit
\Windows\system\rundll32.exe

Filesize
83KB

MD5
48324377bf908f038418fe58237fcc8a

SHA1
5adf728d374a45d7253394a0224cb3a9287e5325

SHA256
21617becccb02e212390df681ee0803db1e6b38a71f67c714c3377a47d9c7eda

SHA512
039dd5e617ced045b1388da4bc4dc39bedad6ab9cb0a167bdfe5cd252ff9ab6a8450b5c8921b16232b63b7e772cac9923667b8a3ce85fe6c2563b95614506c43

Download Submit
memory/1996-0-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/1996-18-0x0000000000420000-0x0000000000436000-memory.dmp

Filesize
88KB

Download
memory/1996-17-0x0000000000420000-0x0000000000436000-memory.dmp

Filesize
88KB

Download
memory/1996-21-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/2292-19-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads