Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
10/11/2024, 01:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe
Resource
win7-20241010-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe
- Size 75KB
- Sample241110-byd4tawkav
- SHA256 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f
- MD5 24370f3376c09a5cc80d9672c5010dd3
- SHA1 5d40eac4b6577353d78025176b3bcf2385d856c3
- SHA512 f4eb64604d15e4b5065b137e1fde01bbe39c9af42fdbf7fe94960af430a9c557dbcba4d8339eeeefcd302ee4c3472c075793f0e7f73c4c9aad49da5b4e816ffc
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOZ/l:GhfxHNIreQm+HiA/l
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 224 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe File created C:\Windows\SysWOW64\¢«.exe b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe File created C:\Windows\SysWOW64\notepad¢¬.exe b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\system\rundll32.exe b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe File opened for modification C:\Windows\system\rundll32.exe b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1731202373" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1731202373" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 224 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 224 rundll32.exe 224 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4844 wrote to memory of 224 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 86 PID 4844 wrote to memory of 224 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 86 PID 4844 wrote to memory of 224 4844 b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe"C:\Users\Admin\AppData\Local\Temp\b72b5f48866c383cc740de002265fb8bf0a3910a7995d3c395509a291245962f.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:224
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 75KB
- SHA256 1aba72d25446fb5461afec1ee20fe13fbe3513d0b997bf3cb33f65a5ce8af59b
- MD5 5bf0570921a1ad7bbb8b1600df03342a
- SHA1 77d0eb908287c4e29fc9056ca5752fb15bea3671
- SHA512 238d26a90e4416db34ff80d17a3baf9d8481465fab9e6b4ba535488fd20dce42deabd2b2c80b64f4791894c2c882a3583fd45901506b12a1ba38293836fd68a9
- SSDEEP 768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOPB:RshfSWHHNvoLqNwDDGw02eQmh0HjWOPB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\rundll32.exe
- Size 82KB
- SHA256 6502bd6a4ca0289792f79052ed58d3996f9eb96b143062f28ac283c7fa953357
- MD5 2308ccf48bce3dd035f62fcf097acf93
- SHA1 74831ace10aa88cbfa8135044c3f19e4a920a9b3
- SHA512 710d399848580dcff3f2d02bdb6f4ddd4ca0ec0c0183a8e17155e79920dccea2cf44f9f2a2136781ff202cfc4d56da4b75f724698cd29cedbdad0fd1499e3d77
- SSDEEP 1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOj+oaC:GhfxHNIreQm+Hi6+oaC
- MD5 SHA1 SHA512 SSDEEP