Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 22:29

General

  • Target

    585327f74832399d29bcb33c6feaeb02e2eeb1c7666ab3f8af6af17289de5424.exe

  • Size

    76KB

  • MD5

    35e6553966b2b9f659b315f2448d8ee3

  • SHA1

    89c5cc10ed81ed3d1e3a829e692f4907fc6c043c

  • SHA256

    585327f74832399d29bcb33c6feaeb02e2eeb1c7666ab3f8af6af17289de5424

  • SHA512

    33f73ae37e22ca29c17c4df1f96b7d20c354f87463098fffd3d8ca14253a7d38734d789590dd31db0a0d6ce10a55a25ed252ac585f7849d75178666940f532f6

  • SSDEEP

    768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOzw:RshfSWHHNvoLqNwDDGw02eQmh0HjWOs

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\585327f74832399d29bcb33c6feaeb02e2eeb1c7666ab3f8af6af17289de5424.exe
    "C:\Users\Admin\AppData\Local\Temp\585327f74832399d29bcb33c6feaeb02e2eeb1c7666ab3f8af6af17289de5424.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    78KB

    MD5

    e0d2bb595732265e7d785f0b652f035d

    SHA1

    6d4c1d1d0dff305a57b0ca818ba8e19af72a4911

    SHA256

    c446744fdcb4f9ae94a6236bf626f7bfdda0d4a6e8471e21915d027b129dcd3d

    SHA512

    b04f3394aa7970228c8f599356f2347cdbb5d2a6dea4585290a9581e1e0f06697f79d30246d94c91b1ac37cd7da1594c2d7c378f0e9888f115dd9557e4e84de3

  • \Windows\system\rundll32.exe

    Filesize

    73KB

    MD5

    d2c0dd76e05e3ed2106089468b2d65a2

    SHA1

    642967312de7e370e19515651b6cb460bec6e87e

    SHA256

    13cd0eb0d1b9065937173ff5e79f8b5088e0690d65e60d3782a491366697d2e3

    SHA512

    8e9c96fe25347aa869797e0ceba8adf0d74ad34a76a24e4fb9eb23dfdfe521b130802e3b2c8ee303f365b2bce51e70ff7bd211645c0c20b79a7ceba5d0dfc69a

  • memory/1028-20-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2736-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2736-18-0x0000000000270000-0x0000000000286000-memory.dmp

    Filesize

    88KB

  • memory/2736-19-0x0000000000270000-0x0000000000286000-memory.dmp

    Filesize

    88KB

  • memory/2736-21-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2736-22-0x0000000000270000-0x0000000000272000-memory.dmp

    Filesize

    8KB