Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe
- Size 74KB
- Sample240602-2efreaad92
- SHA256 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3
- MD5 9e9cc7249bec459b0a332cb541ee7813
- SHA1 366488c68dc69ff3cf25060e307f931899652a85
- SHA512 855fedf460c513fed3512346eec564453c2ba6c7711cc7e01a2925b4403cfd8e4a0807d6d5fb6eafe1157d43e56366ca9b4dc00f60964355099b83386c8695c0
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOrrc:GhfxHNIreQm+HiYrc
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3904 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\notepad¢¬.exe f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe File opened for modification C:\Windows\SysWOW64\¢«.exe f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe File created C:\Windows\SysWOW64\¢«.exe f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe File created C:\Windows\system\rundll32.exe f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe - Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717367377" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717367377" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3904 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 3904 rundll32.exe 3904 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 436 wrote to memory of 3904 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 94 PID 436 wrote to memory of 3904 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 94 PID 436 wrote to memory of 3904 436 f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe"C:\Users\Admin\AppData\Local\Temp\f617a212afe8dccf8e5563ba56c9af214aa9ec2ec51fc479c7437b2d25cfdce3.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1032,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:81⤵PID:4976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 77KB
- SHA256 c82d99416bfdf6e8785c5962b560156fd00322b85f136b454848a16769901f68
- MD5 ad57fd5b53cbd9b8a4b80bd5d4c1b538
- SHA1 246d17d6bcb73b32b60e5b27d68cb99cab61398a
- SHA512 131d39bb9262e3e2af8faa105a725fe00f180ac6c43fcf97a4504895399e22293ae5106df1ed09a1eb88b93fd427900fbff127ee76103ecf3a32aee75c3726bd
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWORS3u:GhfxHNIreQm+Hi+S3u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\rundll32.exe
- Size 77KB
- SHA256 61f1dbaf3d1aeb7951afe26cf84594e94aeb5867b642ed5938ab68004d533566
- MD5 bfe710448cdca827b09db8c89136f6fc
- SHA1 f2d400c886edf5430ae67ccef24732d67c299cb1
- SHA512 dfbcc25e6d092985af48a7453f38f2e447b331e98303f78ed54726b5ef73e1d194e4a61d9e8706184595991d3b97dede27e37eb6ae525ea1f416c38cddf7be1c
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOCzlAg9:GhfxHNIreQm+HihzlAg9
- MD5 SHA1 SHA512 SSDEEP