eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4

General

Target

eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
Size

79KB
MD5

0bce44a1f635f6ead24d377602202e7f
SHA1

4c0381cce3726ce6bdd7f39fc5bd2e21369c964a
SHA256

eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4
SHA512

58ad54067a48b6e7a8187cf4bfec7142ff33c1f010386bdeec3279ec630048be32ee25c130c6abc213805143dc84081fd834006d9c93ea081d3e938ff79268e9
SSDEEP

1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOx5KVFhLh1oRci:GhfxHNIreQm+HidvjDi

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2772	rundll32.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\¢«.exe	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
File created	C:\Windows\SysWOW64\¢«.exe	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
File created	C:\Windows\SysWOW64\notepad¢¬.exe	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\rundll32.exe	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
File opened for modification	C:\Windows\system\rundll32.exe	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717403372"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717403372"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
2772	rundll32.exe
2772	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2772	2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe	95
PID 2000 wrote to memory of 2772	2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe	95
PID 2000 wrote to memory of 2772	2000	eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe	95

C:\Users\Admin\AppData\Local\Temp\eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe
"C:\Users\Admin\AppData\Local\Temp\eb6a8124d50afc21f64437a3769a61f843a5fb8beb6375115b73da999222b4a4.exe"
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system\rundll32.exe
  C:\Windows\system\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3744,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:8
1⤵
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\notepad¢¬.exe

Filesize
73KB

MD5
9092157eb1ab8e28e344a3e27a199ffa

SHA1
32ee2db01afeffd14a8f77fbfa095d2d408bebde

SHA256
b981ca4a774fe2575e881214c91e89ed19664b0d0dd854e0fc7dcf167f84593f

SHA512
c7227dc3ae53f228adc36e5aeb664c290b3f2e22844c594dd57de96eb8b9b5faa8b71f9aaa4066af866c217f67f54592feae7db09c31fb9ed570b585d25de08f

Download Submit
C:\Windows\System\rundll32.exe

Filesize
84KB

MD5
98716e4e8ff1f98e6ea0698b00330d9e

SHA1
f362f5c4eb2a2152c73b756f8e99e61b91825826

SHA256
a617e441945148529e07db4a84a9f8d6b9d3fc3efccbe2cb0ac546cfe58cf69f

SHA512
4f63ef87c799caff56cae7800c68f02206219f3bc8c48c889a66b9d5ce2c517aee40f19f6fdac774775678383a67cf839845b21cce36690969d80d0afe3be2d9

Download Submit
memory/2000-0-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/2000-14-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/2772-13-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads