Analysis
- max time kernel
150s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 03:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe
Resource
win7-20240611-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe
- Size 73KB
- Sample240613-d557zsshjh
- SHA256 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053
- MD5 9b0a6f72f631c39da3a147797f75ee7e
- SHA1 6fcfbdad47b949452d9776d476aed2e002e030ec
- SHA512 10a3eef8f130e73a751749185234f2d211acfe1137ddcecdd4b628be51789a74f274407d3e7f8c5403dfac6244b9645aa5afa40af824db608440fa8702b1ba27
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOz:RshfSWHHNvoLqNwDDGw02eQmh0HjWOz
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4988 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe File created C:\Windows\SysWOW64\¢«.exe aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe File created C:\Windows\SysWOW64\notepad¢¬.exe aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe File created C:\Windows\system\rundll32.exe aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718249802" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718249802" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4988 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 4988 rundll32.exe 4988 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4144 wrote to memory of 4988 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 84 PID 4144 wrote to memory of 4988 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 84 PID 4144 wrote to memory of 4988 4144 aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe"C:\Users\Admin\AppData\Local\Temp\aef87b66e4720df6540781349f0506c681abd54d5cf17b8740a700759d1b1053.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 83KB
- SHA256 d0a3b59dc28a6807f7c5173719c1e178ff20373796d96ced23c6cfe5a577998c
- MD5 49ab16494b28dff139a645cc66fd505c
- SHA1 6060350aeebc4dd80b215e31bb190a1d211be125
- SHA512 31d969b12d13ae2249b2c88ae525df5f0812bf61d2804c8dc70fff3644fa8d70ba479961cc9f1279b5ad46926e67dacb179b4fbf2c535b3ab87c6271021ed9f0
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOeN2HKmn0nW:GhfxHNIreQm+Hi3N2HKmn0nW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\rundll32.exe
- Size 79KB
- SHA256 2f7b5fb1b10fbfcd6483ac338d9802ee46d1857ced32985f3b9fd0ceb27500aa
- MD5 6ab4f2558e607dfe80cf91aa60be1f42
- SHA1 d4c5fa3f50c1b7e2026df809b746064c7c2f739d
- SHA512 d62223f2fbe15d2346422b61849e597b2d831cb7d5823d7929b6ebb513d2df59b70622e949a03aac4aa72e9f51cf8702207304c3463432211435e946e5c7617c
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOtFZ1Z:GhfxHNIreQm+HiSZ1Z
- MD5 SHA1 SHA512 SSDEEP