Overview

overview

7

Static

static

3

8345448dc9...cb.exe

windows7-x64

7

8345448dc9...cb.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 02:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    8345448dc9a83789b8bbb18edf41d03e1e0d5e34c5cb1ae96a153c6752fadfcb.exe

  • Size

    81KB

  • MD5

    0638b9d5da4dfdb55ab294499813b93b

  • SHA1

    9b0eae0a06671cf1866da8ae52f231f2fd99511b

  • SHA256

    8345448dc9a83789b8bbb18edf41d03e1e0d5e34c5cb1ae96a153c6752fadfcb

  • SHA512

    3c7495ecbc2e77e369c7c1c8906b2ace4646610effe564f05cfbb47a79affcb29177af340eb798026ba74ad3072aba2ac992fcc8c9a46708f844d77ce37b6c47

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWODJZ:GhfxHNIreQm+HimJZ

Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
    persistence
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8345448dc9a83789b8bbb18edf41d03e1e0d5e34c5cb1ae96a153c6752fadfcb.exe
    "C:\Users\Admin\AppData\Local\Temp\8345448dc9a83789b8bbb18edf41d03e1e0d5e34c5cb1ae96a153c6752fadfcb.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1068

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\notepad¢¬.exe
          Filesize

          73KB

          MD5

          d09b8c87cca4ddb2ca325a6d60ae6498

          SHA1

          2cdd2e2be46d919fc760e87dfe8073aeb7da4749

          SHA256

          6e7d21c59eb80012b6f4e89790c6c3bd087cce5ea0f25806a9d03debf9ae3178

          SHA512

          3299fca8ec940001f566e087183f3d7bb681cbf47b1f1f6106f13af868f6224a3ce67c93a554d06678b657106e675bc1a27330527414f02c7278b2e073bb96f4

          Download Submit

        • C:\Windows\System\rundll32.exe
          Filesize

          77KB

          MD5

          f09ece9336c47b09972ae29bfba2be2b

          SHA1

          2e137de7f69bf6ad6585572b3e9b3f32e6aa08d3

          SHA256

          c2994ca8b966fafe6a674ee924e4b95eb3c3eb056eb0ff11808c22efca2d16bd

          SHA512

          01f935c0405273a254cf506a724fe4474e4439e4c3b5796ad5d76db43976b312b7e78b1b16ac1a6f304f52099bee4f53f74d0200730a6bfc872fa8e893648d13

          Download Submit

        • memory/5064-0-0x0000000000400000-0x0000000000415A00-memory.dmp

          Filesize

          86KB

          Download

        • memory/5064-13-0x0000000000400000-0x0000000000415A00-memory.dmp

          Filesize

          86KB

          Download