Analysis
- max time kernel
149s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 07:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe
Resource
win7-20240215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe
- Size 82KB
- Sample240603-jdfe5shd28
- SHA256 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d
- MD5 13bfb2806ea449633354276e251fdf78
- SHA1 c4f06cc563fa39003751cb00341e812e9bb5119e
- SHA512 345786cca6f265377a7f49c769478fa45ac8caf8adbf085746cfe47442c55056893d3aa3d4269dc6473ce4b2eab0a65a37b07ed8cfd21513c126ebc1a49c8527
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOYH0Z:GhfxHNIreQm+HirH0Z
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5632 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\¢«.exe d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe File created C:\Windows\SysWOW64\notepad¢¬.exe d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe File opened for modification C:\Windows\SysWOW64\¢«.exe d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\system\rundll32.exe d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe File opened for modification C:\Windows\system\rundll32.exe d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe - Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717399979" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717399979" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5632 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 5632 rundll32.exe 5632 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4656 wrote to memory of 5632 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 84 PID 4656 wrote to memory of 5632 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 84 PID 4656 wrote to memory of 5632 4656 d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe"C:\Users\Admin\AppData\Local\Temp\d5e83bfb9c5c7d58cd7a7d238d8f8fa697b4c4beba0154623199791cee400f5d.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 75KB
- SHA256 8504ed9082520020d8c5484f4e5ff7c95831a6d58b31bc1380bc3b8b7bfabe45
- MD5 d7a9d853bace2ad82f6d8de3c608b87f
- SHA1 1f94a1bd239ad673d8deddd5ecdd6b37232e8ef4
- SHA512 b38db1b43b164d55330c96678f38bb21e6ee36f51285b662c08b0dcb22e21272769512e828e88fda17b626594f83900810a6ed76c0477f0a1addf3135cb3267a
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOZH:RshfSWHHNvoLqNwDDGw02eQmh0HjWOZH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\rundll32.exe
- Size 74KB
- SHA256 67f1a250c4ee6a05346d87b12db265852359485c164326411f22b231591689ae
- MD5 bca87940b59eaf55f9ea9021ec6451fc
- SHA1 aeb2ffcb6423e26e728481535675f507517a9034
- SHA512 fabb9cfb382db4699697fd1044e999b9d20951b01c4711e28c3ade94d6bdab9f1117ec00336da03e74659a2379a0ac3c4256deb80561450f50905301f9a0ee81
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO5/:RshfSWHHNvoLqNwDDGw02eQmh0HjWO5/
- MD5 SHA1 SHA512 SSDEEP