Analysis
- max time kernel
149s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe
- Size 73KB
- Sample240603-mn7txsbe9s
- SHA256 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3
- MD5 f1f47e4715c9d3eff5cfc0caf70d4cad
- SHA1 52f42a5479ab18bfe91dd43833fb677259829d57
- SHA512 02a5506de2229b4badd6a5b3caef76b48ee2bfbb98d52ba834a3f4a39268b25539eef940b2519c3024e9bf4f5111c6a691c8104e3a034a175407e5a21a2bc6a1
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOTC:RshfSWHHNvoLqNwDDGw02eQmh0HjWOTC
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4832 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe File created C:\Windows\SysWOW64\¢«.exe 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe File created C:\Windows\system\rundll32.exe 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe - Modifies registry class 15 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717411069" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717411069" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4832 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 4832 rundll32.exe 4832 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1124 wrote to memory of 4832 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 85 PID 1124 wrote to memory of 4832 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 85 PID 1124 wrote to memory of 4832 1124 81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe"C:\Users\Admin\AppData\Local\Temp\81ba6142af953f4f815cdf913c025f72daf2e00e8060f012811d32c1aaa683d3.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 77KB
- SHA256 5d022491a831e81af07cc97cf519dc8c0bc745daa9cdb1e7cc7a7c3609d8c7cc
- MD5 2d562de072c8f2bbd87b56fe53cf17b6
- SHA1 68ab182b170394fce526a286099640ba8384d15c
- SHA512 cc2cda62c1e560c621f5a5de8bb7906ff409e68c0722ed14c53254db1e4315e3b79cf5fd556651fe527e2ba4d9143de4de168875fcabf3e584cf241bb1eb9020
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOyiSB:GhfxHNIreQm+HiPiSB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\rundll32.exe
- Size 85KB
- SHA256 fba7650298cecf2981f4e38cde949f1d86a70186d18fcd3391dd4244a376153e
- MD5 ab44755219568eb44c3df634f2f1789d
- SHA1 ae0141882556dda69b13e90fd2858ababf62f700
- SHA512 849beba14f1a8217af183ea74a5c75db5d7c08c581364e688a9b2e9c6b8a27fe3058b6a19a2bdcb9fda7767287fc6b06ab3a981a46439fdd02fbf6eae1f28856
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOBoRPh9oBA:GhfxHNIreQm+Hi8oRPh9oBA
- MD5 SHA1 SHA512 SSDEEP