Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe
- Size 74KB
- Sample240603-mk1anscf57
- SHA256 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9
- MD5 1f8fb2a86e1b898ae067372b2802b47a
- SHA1 577b187e6b0596b215f7540f52d30de97f0b570f
- SHA512 9aeb41e293901c01d04aaefda4cbe0afb4f491ce1b62d1147648fb093f4cb2d5f4fab0d19d253a2aed415f850750aa4e09149f7374da03d44e69018c9bd125bf
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOvN:RshfSWHHNvoLqNwDDGw02eQmh0HjWOvN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4176 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\notepad¢¬.exe e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe File opened for modification C:\Windows\SysWOW64\¢«.exe e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe File created C:\Windows\SysWOW64\¢«.exe e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe File created C:\Windows\system\rundll32.exe e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717410733" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717410733" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4176 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 4176 rundll32.exe 4176 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4512 wrote to memory of 4176 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 85 PID 4512 wrote to memory of 4176 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 85 PID 4512 wrote to memory of 4176 4512 e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe"C:\Users\Admin\AppData\Local\Temp\e206348eae3bc207fb54359b8cf9c33181b58eff2a7d191835d0dc41900166c9.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 73KB
- SHA256 55cbb727998a8bdf06335f2e0fb6def8cfc4559ad6498fdfe56a3e0ca9607c10
- MD5 1563bbe543911ea46e8068ef8bba868e
- SHA1 d194381c28fe71e7e3b35f0bd18ac8c3ef05c24a
- SHA512 8a33d302b2639c551f9a5f279321ff35a4833e2153f953041479210a2ed2daba89ece653758d8057bcc1fcc5836a68c6c76092f771a1503194fff9093fce99c9
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOK:RshfSWHHNvoLqNwDDGw02eQmh0HjWOK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system\rundll32.exe
- Size 77KB
- SHA256 8177940471eab6c82ca969665ce6fae1accb4e67bbe0051a2834b0d37d908110
- MD5 c5dbd3e64666f2bed0c065d30f76c96c
- SHA1 5298ee253b67a78de20659f954e1c8bd7bc3cdee
- SHA512 a257642a80e2234c21b7e091c484e437258f661b18c104595a638cff200dbe2ef30a30bdde9cae2b629d63eaf0699e858598c5555aaaad0826a4b8da18c8da11
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOkY7:GhfxHNIreQm+HiVY7
- MD5 SHA1 SHA512 SSDEEP