Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe
Resource
win10v2004-20240426-en
General
-
Target
2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe
-
Size
78KB
-
MD5
8da2ad88560f74b77acbe622967a2cbf
-
SHA1
a4fba75a4a1fe6c509f20002eb872bf2dfd34ffc
-
SHA256
2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021
-
SHA512
49c35597127965562b4fd350fc4394cb7360d614cf45661650b84e59e322ed319644365d70bbcb1e184381a5fcdefbdd75ea9f58eb49a30a52b897ce9767f53f
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOtVrk:GhfxHNIreQm+HiiVrk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1144 rundll32.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe File created C:\Windows\SysWOW64\¢«.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\system\rundll32.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe File opened for modification C:\Windows\system\rundll32.exe 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718112791" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718112791" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1144 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 1144 rundll32.exe 1144 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2372 wrote to memory of 1144 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 81 PID 2372 wrote to memory of 1144 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 81 PID 2372 wrote to memory of 1144 2372 2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe"C:\Users\Admin\AppData\Local\Temp\2d4cd31b7a324d8696319891274eaaa9da2802cf9cfc9c78b87ed031fdd73021.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5ee951622ddac01d99192b3d93d3f8a09
SHA101792dd9128e397514cbb7c53029e6c02294f22d
SHA256c78267d510923bbba0405ba7e27bada7c20297b08bbf2d4741f5bac957d0dddd
SHA512e02efeeee9d43432e94b234ee18c55656c7a5f37b53d5a591637793ac1964fe3f4a54d4bda35b4a3d88ff900f0c8d122298ba92b6b8bd13cf0f3a444267832eb
-
Filesize
75KB
MD5c83dac1ebf567cfc52cf43cf006a1426
SHA12b0f3e6f4bf24eef5f69e948c9b50f4124b39087
SHA2569f40bf3e3d4fc8a1ed963c75a3cafce791ef2b554e195d8c64445781c7341d90
SHA512f2d748eca99c49a120746d7078e794b2de75c77c62158d5c71ba05595eddacb898a6d4b1d8d77c2f788aae605ae06a51004f21e6d1fc866435115e5dec748d2d