Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    09/06/2024, 07:32

General

  • Target

    afc22d19136f9db671708293e114ab529bde5a3e0c3a5dce7e5e904d5ad3c8d1.exe

  • Size

    86KB

  • MD5

    32c1d5f7d725aadb8f435d8f47aed08c

  • SHA1

    4bfa5783f61a998c52b6435e97ea5ccc7740a3f9

  • SHA256

    afc22d19136f9db671708293e114ab529bde5a3e0c3a5dce7e5e904d5ad3c8d1

  • SHA512

    02c1766baa4dc877efa5397138cab996bb0866037dc36060d3697601c717faeab8f386bef00ff8abd1892e5a310f603eabbf79ee99ae7d5c9fa7872aec201664

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOOE0SIIeokYMM:GhfxHNIreQm+HiFE0SIIeokYMM

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\afc22d19136f9db671708293e114ab529bde5a3e0c3a5dce7e5e904d5ad3c8d1.exe
    "C:\Users\Admin\AppData\Local\Temp\afc22d19136f9db671708293e114ab529bde5a3e0c3a5dce7e5e904d5ad3c8d1.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:952
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    81KB

    MD5

    c27c5e5d2bbff016226d439d084db31f

    SHA1

    52ed7998424fd004742973c402b06c973b10a449

    SHA256

    869297bcfbe5b5eee4eafb354332343490b0d7f263ccfe2218a2a379c01756ec

    SHA512

    2ee5ac9ccf21086dec549ca4043bc96bdc4c6093fb6b3c0e8474c393d689693d75597d7fb0e512eaab1e7f33ed209f1544b42932544dcc52129005b6b2ad5c4b

  • \Windows\system\rundll32.exe

    Filesize

    74KB

    MD5

    7df7466ee7bbec4e07c8161b8fbdc2f1

    SHA1

    6444df507ee2c0cf50439ae1aa7be03ad083e330

    SHA256

    61b4396eabc593b439eb7514e2283f85325f51cd673834b51f20c0309d4f2bd4

    SHA512

    87ae8f4f4acb1a5f124b210c06b99a89579b0351a46a8035a801fe8edf0a5faddfb3f0737319b1451b4ac90eb7503a695646ea9a34a96723dbe99e7a54685a6d

  • memory/952-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/952-18-0x00000000003E0000-0x00000000003F6000-memory.dmp

    Filesize

    88KB

  • memory/952-17-0x00000000003E0000-0x00000000003F6000-memory.dmp

    Filesize

    88KB

  • memory/952-21-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/952-22-0x00000000003E0000-0x00000000003E2000-memory.dmp

    Filesize

    8KB

  • memory/2996-19-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB