Analysis
- max time kernel
57s - max time network
86s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 03:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe
- Size 82KB
- Sample240610-d4h13abf2w
- SHA256 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df
- MD5 6f76a5f9754b3e7fe969c2afbaf7e697
- SHA1 8ac1163b3cc28117b99270e9f356ff31ff04669b
- SHA512 4196d81e7a74b78b8aa629fc4325338f12481f5886c645658cc75c89f8a8d581d340266acdb71106af706c77644acb054f4143f67821079654af08b950ac19f9
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWO7FRzDZz:GhfxHNIreQm+Hi8FRzDZz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4684 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\¢«.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe File created C:\Windows\SysWOW64\notepad¢¬.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe File opened for modification C:\Windows\SysWOW64\¢«.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe File created C:\Windows\system\rundll32.exe be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\MSipv be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1717990857" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1717990857" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 4684 rundll32.exe 4684 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2584 wrote to memory of 4684 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 90 PID 2584 wrote to memory of 4684 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 90 PID 2584 wrote to memory of 4684 2584 be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe"C:\Users\Admin\AppData\Local\Temp\be123b997d2b3a4d5eb69bf13aec13805bf6775a359142f7c06daed2b627d5df.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:3668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 85KB
- SHA256 a6f9b0a95fec24bc19568b05a8fe9fe1de9cc2070932a3fa2fe356949cb9a870
- MD5 a8bd898f392988fd40e295ef69ec6a16
- SHA1 1aec9470947fdbbaf7185ff931c118d104243c12
- SHA512 63af7e3473aaa0416d181737817f9006c0ae269427c942459cb45cbd78b55889d60eea1a125f8bb7d5502e7f1e63d24ed8935b69f4dfccddbea80224a3960576
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWORbTtwQvJCJh+NfDi:GhfxHNIreQm+HiybTyQvJZLi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\rundll32.exe
- Size 84KB
- SHA256 b3cec779d300b8b8c064491b33da393b2eeffcb0e7bd899b1e594817f5b45322
- MD5 5d753bbe76051381d3cff3399739ce36
- SHA1 9f7b058a24c13118f4223f952dccdc8df647549e
- SHA512 17d1fc15c5031919062e31a4a00ecf7b5af40dff4827f5bf99ea8a33c90358f198a34f281c56858e65f932f1018ca2203ea3d18a229daeacac590cee40e59fb5
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOxsPS1c:GhfxHNIreQm+HissPS1c
- MD5 SHA1 SHA512 SSDEEP