Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe
Resource
win7-20240220-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe
- Size 78KB
- Sample240611-2eh7javakd
- SHA256 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b
- MD5 1f68347d7b80b71b366176f7fdf13eda
- SHA1 cc757e078287f3b9d72e88aaccdf9f41146a9a5a
- SHA512 b8328832f6f6ce8183235cfa6fae84325a09a5fe100a1d330c3edc12907dc3b5b37ef4a3f60965000d63473a3c2b7ff41ede9a5943895670b63a59be8e1f0ba0
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWONbZcvbF:GhfxHNIreQm+Hi+bZcvbF
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 696 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe File created C:\Windows\SysWOW64\¢«.exe 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe File created C:\Windows\system\rundll32.exe 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\MSipv 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718144981" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718144981" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 696 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 696 rundll32.exe 696 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 656 wrote to memory of 696 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 82 PID 656 wrote to memory of 696 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 82 PID 656 wrote to memory of 696 656 37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe"C:\Users\Admin\AppData\Local\Temp\37783acae148c9449d492c24c9ff8eb691e529752f596e51ebf6b1d64b14970b.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 74KB
- SHA256 e59c5ff1cb41b7f359bfdb65a214a89f18f97285386897fc36607e0af7301bfe
- MD5 ce1bae6d3c19988d38e033457725b5cd
- SHA1 b234a06ed1205e3e35f1b88634e6016dd35bb6d1
- SHA512 260f4f505b8cf216baab2e06369d59dbafb4d155c941d9c6a296d5e0dd7d9cc48a3a9f7e9bdb0ec2fb1b40d36620490bb1833b2af12a5ebb679bc385ae394f7c
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOZ:RshfSWHHNvoLqNwDDGw02eQmh0HjWOZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\rundll32.exe
- Size 74KB
- SHA256 cf2d5866b013182737bac2fc9fa94733c41cbedcf38f03edc41115c366c73154
- MD5 d47f16ba371a2c0fa30aa78e6e48042b
- SHA1 9f4a5b4060a033c34abc02ce0b8a6bf597a51e6e
- SHA512 55420fbfb6584894cf27fdcbd32af2fa3630cc9328c15e517c66b76a0b9193820a2eb77c1e4a497cc2a21d39ae4c7c8406f912d65ce6a8d48f2cc2bbebad2c38
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOz:RshfSWHHNvoLqNwDDGw02eQmh0HjWOz
- MD5 SHA1 SHA512 SSDEEP