Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/06/2024, 07:32

General

  • Target

    7e898f085c4fe23dd6e569fa71a779748d4306c7345e4a861001cbe4614ce3a1.exe

  • Size

    83KB

  • MD5

    a30c00facb37b0cf86b6b7046b591093

  • SHA1

    bca448e37862ffe99fd8311660ea343b6aa2e0de

  • SHA256

    7e898f085c4fe23dd6e569fa71a779748d4306c7345e4a861001cbe4614ce3a1

  • SHA512

    ba167d16ea4b1a3334793bd2e6b321ff72a76b97aa73bdfc9868b7e53bd0061535f249c2c0b11aa99ec4d13d4b832565f3607511b011092a2aa31f678684b615

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOvRhwqe0AJbE3oK3e4w8:GhfxHNIreQm+HiURhwqe0AJbE3oK3e4p

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e898f085c4fe23dd6e569fa71a779748d4306c7345e4a861001cbe4614ce3a1.exe
    "C:\Users\Admin\AppData\Local\Temp\7e898f085c4fe23dd6e569fa71a779748d4306c7345e4a861001cbe4614ce3a1.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    81KB

    MD5

    c27c5e5d2bbff016226d439d084db31f

    SHA1

    52ed7998424fd004742973c402b06c973b10a449

    SHA256

    869297bcfbe5b5eee4eafb354332343490b0d7f263ccfe2218a2a379c01756ec

    SHA512

    2ee5ac9ccf21086dec549ca4043bc96bdc4c6093fb6b3c0e8474c393d689693d75597d7fb0e512eaab1e7f33ed209f1544b42932544dcc52129005b6b2ad5c4b

  • \Windows\system\rundll32.exe

    Filesize

    74KB

    MD5

    7df7466ee7bbec4e07c8161b8fbdc2f1

    SHA1

    6444df507ee2c0cf50439ae1aa7be03ad083e330

    SHA256

    61b4396eabc593b439eb7514e2283f85325f51cd673834b51f20c0309d4f2bd4

    SHA512

    87ae8f4f4acb1a5f124b210c06b99a89579b0351a46a8035a801fe8edf0a5faddfb3f0737319b1451b4ac90eb7503a695646ea9a34a96723dbe99e7a54685a6d

  • memory/2052-19-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2964-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2964-17-0x0000000000260000-0x0000000000276000-memory.dmp

    Filesize

    88KB

  • memory/2964-16-0x0000000000260000-0x0000000000276000-memory.dmp

    Filesize

    88KB

  • memory/2964-21-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2964-22-0x0000000000260000-0x0000000000262000-memory.dmp

    Filesize

    8KB