Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe
Resource
win10v2004-20240508-en
General
-
Target
232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe
-
Size
76KB
-
MD5
a8b9e862b1d24e9e0b6048d310dd51ba
-
SHA1
5489c0a8a33b382d3542a24366173ad5362eb9cf
-
SHA256
232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a
-
SHA512
779ebcf04da8f5dd00394ca80b30bd244004e7db2eefd2133c0dfd639ac6b2b47661ae194b6b3c3166ff2409853ae523d5fd564722e46b108c2f53509dde4c39
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOX:RshfSWHHNvoLqNwDDGw02eQmh0HjWOX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2780 rundll32.exe -
Loads dropped DLL 2 IoCs
pid Process 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe File created C:\Windows\SysWOW64\¢«.exe 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe File created C:\Windows\system\rundll32.exe 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718112783" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718112783" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2780 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 2780 rundll32.exe 2780 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2780 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 28 PID 2028 wrote to memory of 2780 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 28 PID 2028 wrote to memory of 2780 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 28 PID 2028 wrote to memory of 2780 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 28 PID 2028 wrote to memory of 2780 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 28 PID 2028 wrote to memory of 2780 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 28 PID 2028 wrote to memory of 2780 2028 232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe"C:\Users\Admin\AppData\Local\Temp\232c082c75a639812e2f9026917fe80e3536964ddd23c78ce894e2a6607e5b7a.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD5157fc363e164ef2ec062558defe0e30e
SHA14db1696c329b70f3a3057c7b1fad89dcfc60bcff
SHA256e54037f2d2f05a12a2ee2bc5fd913bb3f92d4533958cd617d76a3dc47bf754a7
SHA51234ee193e16b8f95c805a7f447d483abdf0eb1e1f97c2a8978d107bd7d8e47a9f655a46564f390f72c9550463e60ecd2ec509e2c97b91892425ca4cfb6f4c5e57
-
Filesize
82KB
MD578253eda55f949a76113cad10f540c41
SHA164b658a4d3a460ae2636649fd80e181c859c0e2e
SHA25602f7b4467bd0b42fb508abee7088b1d6f3b70ae9c68e961c6bb71987edeca0af
SHA512463dcf50bfa7676417d7d15c9b742fc2e3606625da1e2fcbaae871f8fdb3b720a8fd388b2e3a655ce8032a05af310261dfb41274e7a49f7554b5ae6083aa66d1