Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 02:42

General

  • Target

    66c0fe59c7ce71778fca856e96c5868b4f40900d9924efc317e2401785c33dff.exe

  • Size

    81KB

  • MD5

    71d163c173002cb4422c45d6db9591a3

  • SHA1

    4a667fe17593d1d169cbfe1aff53f74858c5d477

  • SHA256

    66c0fe59c7ce71778fca856e96c5868b4f40900d9924efc317e2401785c33dff

  • SHA512

    e8f25be89d7088e088d033d5f58f926a03faf4babc4d9fe405e3a15c12d99c45184d9ba15fae02668ef273d7d08f7c422d3cd8cd75bf66dd382daf59349181d4

  • SSDEEP

    768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOp/:RshfSWHHNvoLqNwDDGw02eQmh0HjWOb5

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66c0fe59c7ce71778fca856e96c5868b4f40900d9924efc317e2401785c33dff.exe
    "C:\Users\Admin\AppData\Local\Temp\66c0fe59c7ce71778fca856e96c5868b4f40900d9924efc317e2401785c33dff.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:4940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe

    Filesize

    83KB

    MD5

    ecd5eb607043d830481ec58aaa34cbe4

    SHA1

    cda68ee968baf547370e7cc19d4061b3622b19fe

    SHA256

    b610697ab4e72bfe9c452257ce41aff07efe2fb251ef7f4bb301e3d1cd96c9cd

    SHA512

    9be3b2f20cfc21e9a7bf701efc31e4821eab214cff632d6db647292f9c5d9ea926c7442de3c89360b828ced5864514b3c516e883486e17cc6279ec768e1dc203

  • C:\Windows\System\rundll32.exe

    Filesize

    81KB

    MD5

    d8b8995f8a6c85450522a6203e9224e8

    SHA1

    741521abf99b88551be917f4742141a59819ec1b

    SHA256

    6a20c8cf18683a0b266085e14b24ea661cf37424d16ef1a1b80b322ab5563f19

    SHA512

    bcb81245bc8dcc51d28a963ba955241726664f02c024d93baaffbfc7e04f3426b035c4d812a5ce363ca41500b4dc75ce1d1f9e2c21c970a20ec259cc08b426ff

  • memory/2968-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

  • memory/2968-13-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB