Analysis
-
max time kernel
149s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe
Resource
win10v2004-20240426-en
General
-
Target
0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe
-
Size
74KB
-
MD5
f8ff948f5691c5708990e9d09d8b1569
-
SHA1
fc8023073cf8ab2167bef78e2a74b999e297e16f
-
SHA256
0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4
-
SHA512
c8bb5c8f26439246b53d159bf1cd3c0e51f673b593d29855bf256b4374b8610e92a4d64f18a061b36ad692bf67401e8d35b7eebd93351ec8e0fc6e531389e44a
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO:RshfSWHHNvoLqNwDDGw02eQmh0HjWO
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3024 rundll32.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe File created C:\Windows\SysWOW64\¢«.exe 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe File created C:\Windows\system\rundll32.exe 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718105380" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718105380" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 3024 rundll32.exe 3024 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2664 wrote to memory of 3024 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 80 PID 2664 wrote to memory of 3024 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 80 PID 2664 wrote to memory of 3024 2664 0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe"C:\Users\Admin\AppData\Local\Temp\0c3eb47bf0f4c392b7834985a5eb1c8f88b345d1ecbe1f201270751c8c37aeb4.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD51b793f4464e6fefe6aaad7195a299381
SHA1f504547d3e11862432202eab416514a672f15572
SHA256adc5ed2bf1ba84c0dd2e02cc9de36d80e17a4cf5233144507921c3fdf89a5856
SHA512df242a7ec9a9e9019521db7462668d9da6ee62436f965732de0b82e4b1b96b62dbe875ce2068ac58f4c9d26baeee586db98e725f72e1cb76bfdad6db19ee7a57
-
Filesize
82KB
MD524aa32c0452c4abce82f65f59d063c60
SHA15de7878b284cee2e5463869e7c2f22d8f0a9b2fe
SHA256454f8501117f113a2fbd60a4ded743cff9f051a25ed50428549fb7c0d5956f54
SHA512c63623160177c6b4bc601b329b69b1a7a73d2701c71f240ab833978cf332d20de1c4d538a694a94a1c037a91593910832de08c256a2744eb16720c0c6aa1dee1