Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe
Resource
win10v2004-20240508-en
General
-
Target
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe
-
Size
83KB
-
MD5
9632e7941853f0533aa1de7522fbc5f7
-
SHA1
6ce7284b526b08c7b5f196bb0c5a4ec7530a20d9
-
SHA256
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386
-
SHA512
e4f11963c2bb4175c99fc352edeadea1ff23c0eca4588bd236ff6fd2d244bda3ede66af92eacfb1d364925134ca4fb6d305fcc259095068f3aef2e96982f3cab
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOoMl:GhfxHNIreQm+HiTMl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32.exepid process 380 rundll32.exe -
Loads dropped DLL 2 IoCs
Processes:
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exepid process 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
Processes:
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exerundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe -
Drops file in System32 directory 4 IoCs
Processes:
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exedescription ioc process File opened for modification C:\Windows\SysWOW64\¢«.exe 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe File created C:\Windows\SysWOW64\¢«.exe 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe -
Drops file in Windows directory 2 IoCs
Processes:
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exedescription ioc process File opened for modification C:\Windows\system\rundll32.exe 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe File created C:\Windows\system\rundll32.exe 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe -
Modifies registry class 15 IoCs
Processes:
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exerundll32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\MSipv 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718130648" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718130648" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exepid process 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rundll32.exepid process 380 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exerundll32.exepid process 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe 380 rundll32.exe 380 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exedescription pid process target process PID 2488 wrote to memory of 380 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe rundll32.exe PID 2488 wrote to memory of 380 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe rundll32.exe PID 2488 wrote to memory of 380 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe rundll32.exe PID 2488 wrote to memory of 380 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe rundll32.exe PID 2488 wrote to memory of 380 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe rundll32.exe PID 2488 wrote to memory of 380 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe rundll32.exe PID 2488 wrote to memory of 380 2488 09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe"C:\Users\Admin\AppData\Local\Temp\09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\notepad¢¬.exeFilesize
75KB
MD5ece57323f96cd3e812d60d8ad75e05d7
SHA1531d583c8037ff0911db2af78459897c868de92b
SHA256c4ebbfb79ef70b9f9cb69551a909dbd9d62b587f7072e64a8061d6aac550c9ae
SHA512c0ae9d0ab20db37191133769d05560b82be5f12a36d5cc4730c0478efd5fbee019a9370a06e42d0a8290684e76a26f8de6aeaf9af175768c758dbfa3c91d4598
-
\Windows\system\rundll32.exeFilesize
76KB
MD505bb87807d0889fda9810572796491e5
SHA1dac7d608be9379f7089d506a3b0670c836d2ab92
SHA25603977952febfbab9e832512b34b7b6eeffe72c4a49300bc03805e4d5a4217e00
SHA5125176c9d982cc0a298a7f97982ee0e31e50a9da588168989fd28050c1b80744a09668536185680633b7296b1202a8841cd4fdd068e1069098f4bbf8396d751a47
-
memory/380-19-0x0000000000400000-0x0000000000415A00-memory.dmpFilesize
86KB
-
memory/2488-0-0x0000000000400000-0x0000000000415A00-memory.dmpFilesize
86KB
-
memory/2488-18-0x00000000003E0000-0x00000000003F6000-memory.dmpFilesize
88KB
-
memory/2488-17-0x00000000003E0000-0x00000000003F6000-memory.dmpFilesize
88KB
-
memory/2488-21-0x0000000000400000-0x0000000000415A00-memory.dmpFilesize
86KB
-
memory/2488-22-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB