Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 11:29

General

  • Target

    882102817c55b1f884a9256061123dc0508714992326ea92f4927dd8ec0ef27b.exe

  • Size

    84KB

  • MD5

    60a2358e346d88c4a2709a21f2584979

  • SHA1

    30a39b0e0cfd478c59bb92b30da0f0799892567b

  • SHA256

    882102817c55b1f884a9256061123dc0508714992326ea92f4927dd8ec0ef27b

  • SHA512

    6b80575dbd93bcb23a02026ac3e2f88b20e54b3f26fdc168afa95b90cded92b1e79e9c9e0a27edcfb11291335364d485ea0d13e388cd760f4d6c7659c53ed41d

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOr/BVNJ2oT:GhfxHNIreQm+HiE/BVNJ2oT

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\882102817c55b1f884a9256061123dc0508714992326ea92f4927dd8ec0ef27b.exe
    "C:\Users\Admin\AppData\Local\Temp\882102817c55b1f884a9256061123dc0508714992326ea92f4927dd8ec0ef27b.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2804

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\notepad¢¬.exe

          Filesize

          82KB

          MD5

          119e2d2afad371e84a15ce4c6cbee915

          SHA1

          6added3df41f758dbc41f3b1604da16799a58315

          SHA256

          79881e5d40220dec9b02f986573a72ae930c640bb636a6e6ca2431614640f0da

          SHA512

          2075ea6123e94f7bc2ecb95a2507492cc0ed66d43c485aa6724d7271da45050a1130aeeaef048bb442f335342a8c19af1965b4677e9a7676f9bf364c2b51129b

        • \Windows\system\rundll32.exe

          Filesize

          80KB

          MD5

          392b084170dd4bb9e657a915a02a07a5

          SHA1

          9d7aea4eb1bbdb2c21eb464f3f6f275a473be07a

          SHA256

          cf504e1b9849d8c1d5225846f7f4c440f6db784c9e0bfba976cfaec1a9d9ec03

          SHA512

          5bc1b4a3dbdbc8a70d3fcb748963679621939eb702a5ccea44d52fc4bf91d44d967d9a534b5524e9a41960ba3710cd08915d91d291f472d3d645b67c23a0135a

        • memory/1724-0-0x0000000000400000-0x0000000000415A00-memory.dmp

          Filesize

          86KB

        • memory/1724-16-0x0000000000330000-0x0000000000346000-memory.dmp

          Filesize

          88KB

        • memory/1724-17-0x0000000000330000-0x0000000000346000-memory.dmp

          Filesize

          88KB

        • memory/1724-21-0x0000000000400000-0x0000000000415A00-memory.dmp

          Filesize

          86KB

        • memory/1724-22-0x0000000000330000-0x0000000000332000-memory.dmp

          Filesize

          8KB

        • memory/2804-20-0x0000000000400000-0x0000000000415A00-memory.dmp

          Filesize

          86KB