Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe
Resource
win10v2004-20240426-en
General
-
Target
f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe
-
Size
81KB
-
MD5
a768b21b3e687cdd3d3849bea2308312
-
SHA1
c72a66cc8bf608499f8a93ca2c9ab2e82a3d75de
-
SHA256
f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39
-
SHA512
c2904fa97aef192783ba4cd0ca001ec564121120a1d29e50d658a9f66fc2c01a53c51df14d3703b00b623ed6e23306f30865e64e74ab13bec23661c5d070ab6a
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOi4t1:GhfxHNIreQm+HiJ4t1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2472 rundll32.exe -
Loads dropped DLL 2 IoCs
pid Process 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe File created C:\Windows\SysWOW64\¢«.exe f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe File created C:\Windows\SysWOW64\notepad¢¬.exe f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe File created C:\Windows\system\rundll32.exe f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718112791" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718112791" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2472 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 2472 rundll32.exe 2472 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2472 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 28 PID 2240 wrote to memory of 2472 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 28 PID 2240 wrote to memory of 2472 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 28 PID 2240 wrote to memory of 2472 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 28 PID 2240 wrote to memory of 2472 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 28 PID 2240 wrote to memory of 2472 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 28 PID 2240 wrote to memory of 2472 2240 f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe"C:\Users\Admin\AppData\Local\Temp\f9cf89a4ee8ac44cb01eec76789801103566fd745f4ae0a1fd0936d3bdbf3e39.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5ee951622ddac01d99192b3d93d3f8a09
SHA101792dd9128e397514cbb7c53029e6c02294f22d
SHA256c78267d510923bbba0405ba7e27bada7c20297b08bbf2d4741f5bac957d0dddd
SHA512e02efeeee9d43432e94b234ee18c55656c7a5f37b53d5a591637793ac1964fe3f4a54d4bda35b4a3d88ff900f0c8d122298ba92b6b8bd13cf0f3a444267832eb
-
Filesize
75KB
MD5c83dac1ebf567cfc52cf43cf006a1426
SHA12b0f3e6f4bf24eef5f69e948c9b50f4124b39087
SHA2569f40bf3e3d4fc8a1ed963c75a3cafce791ef2b554e195d8c64445781c7341d90
SHA512f2d748eca99c49a120746d7078e794b2de75c77c62158d5c71ba05595eddacb898a6d4b1d8d77c2f788aae605ae06a51004f21e6d1fc866435115e5dec748d2d