Analysis
- max time kernel
147s - max time network
119s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
10/06/2024, 03:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe
- Size 82KB
- Sample240610-d4h13abf2w
- SHA256 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df
- MD5 6f76a5f9754b3e7fe969c2afbaf7e697
- SHA1 8ac1163b3cc28117b99270e9f356ff31ff04669b
- SHA512 4196d81e7a74b78b8aa629fc4325338f12481f5886c645658cc75c89f8a8d581d340266acdb71106af706c77644acb054f4143f67821079654af08b950ac19f9
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWO7FRzDZz:GhfxHNIreQm+Hi8FRzDZz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2964 rundll32.exe - Loads dropped DLL 2 IoCs
pid Process 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe File created C:\Windows\SysWOW64\notepad¢¬.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe File opened for modification C:\Windows\SysWOW64\¢«.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe File created C:\Windows\SysWOW64\¢«.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\system\rundll32.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe File opened for modification C:\Windows\system\rundll32.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717990836" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717990836" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2964 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2964 rundll32.exe 2964 rundll32.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2964 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 28 PID 2888 wrote to memory of 2964 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 28 PID 2888 wrote to memory of 2964 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 28 PID 2888 wrote to memory of 2964 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 28 PID 2888 wrote to memory of 2964 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 28 PID 2888 wrote to memory of 2964 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 28 PID 2888 wrote to memory of 2964 2888 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe"C:\Users\Admin\AppData\Local\Temp\be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 74KB
- SHA256 b8dd970719dc8c78c6bd2f4a5fce074a6f2e78ed283d4c42566db7d4f7d39bb0
- MD5 a6dc6f1a99adca2dc57f890b9b4fb830
- SHA1 7de49101c0651ad6d956ac87e41bf3bcba90d0e5
- SHA512 982acba23ec12d506c30b493e2eab7e505b0e93ffa43b13078446aa8eabadce06d2d663850f927983a8a75eddf0163dced7b17664089c25cfb7a89cdd0a0f7c9
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOyZ:RshfSWHHNvoLqNwDDGw02eQmh0HjWOyZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system\rundll32.exe
- Size 81KB
- SHA256 64282d8cd562b4d8a99bd03101aa9ee7709b744af3d5d07ec1144f24f550ff58
- MD5 2cee041465ae1e6ccf4c3907c66e6e43
- SHA1 bb348717d4557e60a80c164c92092e038b1d0666
- SHA512 4c023af2368307cc5a5961962fc8e489a5f1cd4c5130aa942632857ad9cbae1473c65819bbeb43d7895450fc670f965198ee6e9118569f5c40a32a83a53086f7
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOHXX51:GhfxHNIreQm+HiqXX51
- MD5 SHA1 SHA512 SSDEEP