Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 23:43
Static task
static1
Behavioral task
behavioral1
Sample
540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe
Resource
win10v2004-20240508-en
General
-
Target
540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe
-
Size
75KB
-
MD5
8c6ccf2f549a1314eddfad4d85379ff0
-
SHA1
bd625d2e1411c3943f8aa456be80f49699e9eb46
-
SHA256
540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d
-
SHA512
4d63117a8b41bb0d0a246f3f44de12d6259aec2868ae47b00d85b02430b767a36497eccd1ec3742bb564bbfcc71c19971a233765477ffaa66aabd9ac4451e114
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO7L:RshfSWHHNvoLqNwDDGw02eQmh0HjWO7L
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4416 rundll32.exe -
Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe File created C:\Windows\SysWOW64\¢«.exe 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe File created C:\Windows\system\rundll32.exe 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe -
Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718235792" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718235792" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4416 rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 4416 rundll32.exe 4416 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2620 wrote to memory of 4416 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 87 PID 2620 wrote to memory of 4416 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 87 PID 2620 wrote to memory of 4416 2620 540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe"C:\Users\Admin\AppData\Local\Temp\540b9b46991e01bf73a8cc78a980ba003c4c34c416c6f9a3e43815591fa7db6d.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4416
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD57e97abf4ded003b7ca8c18a218d72ac6
SHA1b62bb46371ee5f5c55c9384f2ef6bf3ac4ceb869
SHA25613fc48049c18722a126b5ca44ec76ab528f4c369834e0b371d3e465f7f246f12
SHA512bbb92b6ef2d63d7fa0198905007d19a98640c3b0cb7ae6bab2ef5e516f56cf6ec4e348e1440826b926fdb70acbe793cf86d06ee0707eb5769babbe3d93443799
-
Filesize
79KB
MD55b256c91236dfee07b2259d7187523ed
SHA1cccf8574049e6d5c29636d06c3e40a854818cdce
SHA2560d43bcc7afcc07e5606c06e13f5c825c697a5f6014eb9fe781e64f3d55266bab
SHA512400b5fccbd2b49bc7a9a6cd5daa0f19c3a4f30df68cdbf59322d6e11eed418ee743e83b6f5b64e4c9f617f294f05d26906d36bd36a9f5284b53cc65bbbc3f3d8