Analysis
- max time kernel
145s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 19:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe
- Size 74KB
- Sample240613-yllpfsyfpa
- SHA256 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66
- MD5 875b044aa6bfee02dc40fd71e865754f
- SHA1 23e0eff6b501b91f08e4f8fea56ba226a0d868e4
- SHA512 22bb97b300c7f4a3a4c0152bba21713dd6ffe8d195b78348c2f7fd1b8c001bacc68d7e3cdc3a771b8023b443d5443756f717f451f1515af2c279bd2dc682f481
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO03:RshfSWHHNvoLqNwDDGw02eQmh0HjWO03
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4936 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe File created C:\Windows\SysWOW64\¢«.exe bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe File created C:\Windows\SysWOW64\notepad¢¬.exe bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe File created C:\Windows\system\rundll32.exe bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe - Modifies registry class 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1718308357" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1718308357" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4936 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 4936 rundll32.exe 4936 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 224 wrote to memory of 4936 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 90 PID 224 wrote to memory of 4936 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 90 PID 224 wrote to memory of 4936 224 bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe"C:\Users\Admin\AppData\Local\Temp\bf96e037651fe29869b0c49de6710075088d396e82322a6c4443b7e7c9d91c66.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:81⤵PID:1096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 75KB
- SHA256 1ca222eeec6e39aa720069e84dfb44998372f72c6e697ecff33faabd7e211c86
- MD5 861202e8785db580eef444ec0eeecd78
- SHA1 b8db3a3279cd546e8f59755b6b4ceabedbf88626
- SHA512 b173911a5faf284ef4e7fd84cbe3f326c9bcc0c03b1836cf823e30d3c21d60c1febec58c2ac4576985248a91fe5d47b27a593056f9b50d4f154c8ccb8d8d7038
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOdyZ:GhfxHNIreQm+HiUyZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\rundll32.exe
- Size 77KB
- SHA256 71c1a505aeb9eb96fa64ab6c74a043a25f6e65e2b1f102dd060e97f93a67709e
- MD5 8f51b8ce52a1a714f6351d43ccfbc940
- SHA1 d0279430280885c454ee241573a0b1c6356383f5
- SHA512 6cc410569853e422626094977fa30cfdbcd9048803fb736deadd6c383d61c739b26dd6648406d9509ca23ed1b48b89ad633538021146f8d62327919dfc258970
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWONTMb:GhfxHNIreQm+HiOTMb
- MD5 SHA1 SHA512 SSDEEP