Analysis
- max time kernel
141s - max time network
70s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 03:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe
- Size 73KB
- Sample240610-d4h13abf2v
- SHA256 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7
- MD5 126620d890c5117cc1f6b97187061c73
- SHA1 704815f2c37fcfc38209258ebfa849b388abafef
- SHA512 01f5f60dcd1000aac22c80489675c853beaffee33f38d91b109ac13bf6f64ee0da7d4d884123c78ba393d0319c1fe093ed7ea798cc699839e1d2ce0497acbe75
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOd4r:GhfxHNIreQm+HiE4r
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 684 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\notepad¢¬.exe 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe File opened for modification C:\Windows\SysWOW64\¢«.exe 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe File created C:\Windows\SysWOW64\¢«.exe 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe File created C:\Windows\system\rundll32.exe 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe - Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717990843" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717990843" rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 684 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 684 rundll32.exe 684 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4468 wrote to memory of 684 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 84 PID 4468 wrote to memory of 684 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 84 PID 4468 wrote to memory of 684 4468 471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe"C:\Users\Admin\AppData\Local\Temp\471a760642fc279e79c2ec804232a3d507ace65f09faa0cd8e19e65d3c210ef7.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 82KB
- SHA256 0df2a0b08821a6c42766c4374096d93f0603d8a96a1a13e26f612b2032ed96f2
- MD5 da99830ad9823b8d93ae1ae58ebd7fa2
- SHA1 5b58137cd755a8c8090ae36f15eb95f38b573cf6
- SHA512 f56c31d42e2d60e50e3eeb3edc32caa835ad241568b5d69a69bae3a14fedcf851ee17a445263371dbd9b118b6ce83174f9da7645fd89fabc4fca1f0951e482e9
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOMylf7/w:GhfxHNIreQm+HiDylf7/w
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\rundll32.exe
- Size 77KB
- SHA256 35646ba869d3457c8a5edd5b8c9c9a3226d881d783a4502a13cfeb9fbd188901
- MD5 da1750626f9cad24ee63b087a1516b0b
- SHA1 13e3818ec66ddd9d5c1aa8cd33afc1f93db428ae
- SHA512 5b073c89515a410355015463f0fe3911655cc1941d90690f6f1bb66197216069f4c9c2e07956164874e6988c3185f09a1fbdd6f8cc037f21d8c0d1e2b56a034f
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWO4wq:GhfxHNIreQm+Hifwq
- MD5 SHA1 SHA512 SSDEEP