Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe
Resource
win10v2004-20240426-en
General
-
Target
2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe
-
Size
78KB
-
MD5
8da2ad88560f74b77acbe622967a2cbf
-
SHA1
a4fba75a4a1fe6c509f20002eb872bf2dfd34ffc
-
SHA256
2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021
-
SHA512
49c35597127965562b4fd350fc4394cb7360d614cf45661650b84e59e322ed319644365d70bbcb1e184381a5fcdefbdd75ea9f58eb49a30a52b897ce9767f53f
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOtVrk:GhfxHNIreQm+HiiVrk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2568 rundll32.exe -
Loads dropped DLL 2 IoCs
pid Process 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe File created C:\Windows\SysWOW64\¢«.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe File created C:\Windows\system\rundll32.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718112789" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718112789" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2568 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2568 rundll32.exe 2568 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2568 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 28 PID 1712 wrote to memory of 2568 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 28 PID 1712 wrote to memory of 2568 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 28 PID 1712 wrote to memory of 2568 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 28 PID 1712 wrote to memory of 2568 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 28 PID 1712 wrote to memory of 2568 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 28 PID 1712 wrote to memory of 2568 1712 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe"C:\Users\Admin\AppData\Local\Temp\2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD53928a7bb763829bcb4931c88205a73aa
SHA118d13482c05ece0d6129f12de12b08cbb3fa9fa1
SHA2565f43a36f969396a5057ccca3c1478f462b94a16318d286b45ed0ac08b81b5707
SHA512790fe78f5b2ed460c32047a4b0881395264c503a7006ef2476ee29314b990183e2d8e289d830265af1e568176a112bbc3aa7febf2c8c7e0d54bb0692c2a07261
-
Filesize
84KB
MD5a680889a6e4aef0455468f39a4a67ff1
SHA16f4494bf18da3ccb625650aa4a36923ef8be5a59
SHA256aad4af7fde5fe66b032fc1436cda0110552457c8897f17519e3f132f8b0bd2a0
SHA5126ab89dd1cba57386d81e1fb747625badc5f4f2feb6d9c31ac327dd30c80af750313559d0dca6206518d9dd4f7db21f449b2a365cece5869f7b24e17135ed94f1