f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799

General

Target

f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
Size

76KB
MD5

83adb5c7d7d280a09fa6d98d181a8977
SHA1

31d24b0ed7c44029478684e7849f6a2d01c83076
SHA256

f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799
SHA512

12a28ef8cdb36fc0b5f7be81a30562f6955f345a61c441975f7082c50058d02635a332f7182a573dec1fd550bfbb7d1f2a9932f94bbe5583b587ecbc6e5f5d34
SSDEEP

768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOr:RshfSWHHNvoLqNwDDGw02eQmh0HjWOr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1608	rundll32.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\¢«.exe	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
File created	C:\Windows\SysWOW64\¢«.exe	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
File created	C:\Windows\SysWOW64\notepad¢¬.exe	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\rundll32.exe	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
File created	C:\Windows\system\rundll32.exe	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718156366"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718156366"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1608	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
1608	rundll32.exe
1608	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 1608	596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe	90
PID 596 wrote to memory of 1608	596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe	90
PID 596 wrote to memory of 1608	596	f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe	90

C:\Users\Admin\AppData\Local\Temp\f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe
"C:\Users\Admin\AppData\Local\Temp\f963e49d18d3f63d0a97c708c5d922366bfa2889d6dd288ebc0668c701226799.exe"
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\system\rundll32.exe
  C:\Windows\system\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=1032 /prefetch:8
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\notepad¢¬.exe

Filesize
81KB

MD5
f7eb29434d5715a1539d76b1be4d2877

SHA1
71cda800951e905a3282c0383b7b842c4d9cdbeb

SHA256
6678d6136cce171f7996808570c0c24d97c0638847a4f5cb845cdc4233e99270

SHA512
fa84380a10e6e532ed11cd2049bc1ecafa4e9ffa5e5e473e03247877ac783a7f3d2c77988d26e7bd94b7a76648bf8bd1a31180f00277b8b8a3cf785bebd756c4

Download Submit
C:\Windows\System\rundll32.exe

Filesize
76KB

MD5
53cab00f4c69d25eb7ff644dfa6f615b

SHA1
a106e3ad208eb5c100ccfce88aa20409875a1205

SHA256
c245d013d35d3f7929dc28dd83a9a8bf822265644a24780b2c1271aae0feacc1

SHA512
fd88da66c53cfa0be5932c1b9852abed47351823bc873916ac4e4bb68be8ea9668899c246cd8d3f80c77070168ddb0ccf47fbd39a29deb1907bc8ca33a567a6b

Download Submit
memory/596-0-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download
memory/596-13-0x0000000000400000-0x0000000000415A00-memory.dmp

Filesize
86KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads