6b620d72542aa0284b9fda80cd2c860592473ca610be8729e70091baad32c14b

General

Target

03faea08976b2ec65bf9ee79703dc770N.exe
Size

27KB
MD5

03faea08976b2ec65bf9ee79703dc770
SHA1

6169f9048c91655730e96206b9a7832173263457
SHA256

6b620d72542aa0284b9fda80cd2c860592473ca610be8729e70091baad32c14b
SHA512

55d3ba2b36aaa8fcd5f38acb083a190c3d80fea5d5fc4eecd4b284a51bc7bf998243dacf2e1ab5b6f23a5d9b5c40d3497d0ed739d8f922b7ab4cdf2515007da2
SSDEEP

768:PVEHJqjHyGvwFylDpulVSQJrE/2QmlCYZUbrv:PH2nylslwHCCLP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2484	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	03faea08976b2ec65bf9ee79703dc770N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	03faea08976b2ec65bf9ee79703dc770N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	03faea08976b2ec65bf9ee79703dc770N.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\¢«.exe	03faea08976b2ec65bf9ee79703dc770N.exe
File created	C:\Windows\SysWOW64\¢«.exe	03faea08976b2ec65bf9ee79703dc770N.exe
File opened for modification	C:\Windows\SysWOW64\notepad¢¬.exe	03faea08976b2ec65bf9ee79703dc770N.exe
File created	C:\Windows\SysWOW64\notepad¢¬.exe	03faea08976b2ec65bf9ee79703dc770N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\rundll32.exe	03faea08976b2ec65bf9ee79703dc770N.exe
File created	C:\Windows\system\rundll32.exe	03faea08976b2ec65bf9ee79703dc770N.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	03faea08976b2ec65bf9ee79703dc770N.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	03faea08976b2ec65bf9ee79703dc770N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1"	03faea08976b2ec65bf9ee79703dc770N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1721592616"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	03faea08976b2ec65bf9ee79703dc770N.exe
Key created	\REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command	03faea08976b2ec65bf9ee79703dc770N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	03faea08976b2ec65bf9ee79703dc770N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1721592616"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	03faea08976b2ec65bf9ee79703dc770N.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSipv	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2520	03faea08976b2ec65bf9ee79703dc770N.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2484	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2520	03faea08976b2ec65bf9ee79703dc770N.exe
2484	rundll32.exe
2484	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2484	2520	03faea08976b2ec65bf9ee79703dc770N.exe	31
PID 2520 wrote to memory of 2484	2520	03faea08976b2ec65bf9ee79703dc770N.exe	31
PID 2520 wrote to memory of 2484	2520	03faea08976b2ec65bf9ee79703dc770N.exe	31
PID 2520 wrote to memory of 2484	2520	03faea08976b2ec65bf9ee79703dc770N.exe	31
PID 2520 wrote to memory of 2484	2520	03faea08976b2ec65bf9ee79703dc770N.exe	31
PID 2520 wrote to memory of 2484	2520	03faea08976b2ec65bf9ee79703dc770N.exe	31
PID 2520 wrote to memory of 2484	2520	03faea08976b2ec65bf9ee79703dc770N.exe	31

C:\Users\Admin\AppData\Local\Temp\03faea08976b2ec65bf9ee79703dc770N.exe
"C:\Users\Admin\AppData\Local\Temp\03faea08976b2ec65bf9ee79703dc770N.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\system\rundll32.exe
  C:\Windows\system\rundll32.exe
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\notepad¢¬.exe

Filesize
29KB

MD5
92ab96741a581db3b45987ad016adce1

SHA1
9ebf199972fc70db64c2415a939a20879c5c953a

SHA256
7457193fd928f96c6d4ef549b4185551166829b27edb0d329b851cff96dd8910

SHA512
65f11491a278ae9da39b6aec433ececcd3c03d55827f993fefa99d84a30af68bf21da544abb904e02efb4147454fe22f926e12a7381a5f145c1d886539d2c90c

Download Submit
\Windows\system\rundll32.exe

Filesize
31KB

MD5
a4e2b6133bb18c1067c8f6ff3b0bb848

SHA1
79adc496e9d91b748a243aa72a763cad298d8d8f

SHA256
560eed9b36f428827e63de26a897f0f07fc05736cb4739f56892cb7881b4c9bb

SHA512
bfedd3314bddaeac723489dcfa1cecc548cf5b14426576951de4883f9d4ceb7d00650356ee2cc988d041548479e3902c31e267324eaf95627e55e1fb3e8e7c08

Download Submit
memory/2484-28-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2484-29-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2484-33-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2484-32-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2484-31-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2484-23-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2484-24-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2484-25-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2484-26-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2484-27-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2484-30-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2520-21-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2520-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2520-18-0x0000000000280000-0x0000000000295000-memory.dmp

Filesize
84KB

Download
memory/2520-22-0x0000000000280000-0x0000000000282000-memory.dmp

Filesize
8KB

Download
memory/2520-17-0x0000000000280000-0x0000000000295000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads