Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 13:33

General

  • Target

    232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe

  • Size

    76KB

  • MD5

    a8b9e862b1d24e9e0b6048d310dd51ba

  • SHA1

    5489c0a8a33b382d3542a24366173ad5362eb9cf

  • SHA256

    232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a

  • SHA512

    779ebcf04da8f5dd00394ca80b30bd244004e7db2eefd2133c0dfd639ac6b2b47661ae194b6b3c3166ff2409853ae523d5fd564722e46b108c2f53509dde4c39

  • SSDEEP

    768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOX:RshfSWHHNvoLqNwDDGw02eQmh0HjWOX

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe
    "C:\Users\Admin\AppData\Local\Temp\232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2780

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\notepad¢¬.exe

          Filesize

          79KB

          MD5

          157fc363e164ef2ec062558defe0e30e

          SHA1

          4db1696c329b70f3a3057c7b1fad89dcfc60bcff

          SHA256

          e54037f2d2f05a12a2ee2bc5fd913bb3f92d4533958cd617d76a3dc47bf754a7

          SHA512

          34ee193e16b8f95c805a7f447d483abdf0eb1e1f97c2a8978d107bd7d8e47a9f655a46564f390f72c9550463e60ecd2ec509e2c97b91892425ca4cfb6f4c5e57

        • \Windows\system\rundll32.exe

          Filesize

          82KB

          MD5

          78253eda55f949a76113cad10f540c41

          SHA1

          64b658a4d3a460ae2636649fd80e181c859c0e2e

          SHA256

          02f7b4467bd0b42fb508abee7088b1d6f3b70ae9c68e961c6bb71987edeca0af

          SHA512

          463dcf50bfa7676417d7d15c9b742fc2e3606625da1e2fcbaae871f8fdb3b720a8fd388b2e3a655ce8032a05af310261dfb41274e7a49f7554b5ae6083aa66d1

        • memory/2028-0-0x0000000000400000-0x0000000000415A00-memory.dmp

          Filesize

          86KB

        • memory/2028-15-0x00000000003E0000-0x00000000003F6000-memory.dmp

          Filesize

          88KB

        • memory/2028-17-0x00000000003E0000-0x00000000003F6000-memory.dmp

          Filesize

          88KB

        • memory/2028-21-0x0000000000400000-0x0000000000415A00-memory.dmp

          Filesize

          86KB

        • memory/2028-22-0x00000000003E0000-0x00000000003E2000-memory.dmp

          Filesize

          8KB

        • memory/2780-20-0x0000000000400000-0x0000000000415A00-memory.dmp

          Filesize

          86KB