3460bddb22bbd2c03da5dbcc68e6ce1d54cfb1d5991196eff039acb093d96307 | Triage™

Analysis

max time kernel
138s
max time network
78s
platform
windows10_x64
resource
win10v200722
submitted
05/08/2020, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SHRIKESH_CHALLAN.cmd.exe
Size 632KB
Sample200805-72cdtjalvs
SHA256 3460bddb22bbd2c03da5dbcc68e6ce1d54cfb1d5991196eff039acb093d96307
MD5 528c884771ee6d21e05a993ad7deb16b
SHA1 0fca8a203177c6cbbe718735a3aa726d32f677a3
SHA512 d7099d891feabfcc4576e024fe6deb651730282f14144106fce0b989679d65a3acf55594a675d27423ad237b94ad98712049a953cf3f8275a65892667de5f63c
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3288	SHRIKESH_CHALLAN.cmd.exe
3288	SHRIKESH_CHALLAN.cmd.exe
3288	SHRIKESH_CHALLAN.cmd.exe
1200	mspaint.exe
1200	mspaint.exe
1200	mspaint.exe
1200	mspaint.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 908	3288	SHRIKESH_CHALLAN.cmd.exe	67
PID 3288 wrote to memory of 908	3288	SHRIKESH_CHALLAN.cmd.exe	67
PID 3288 wrote to memory of 908	3288	SHRIKESH_CHALLAN.cmd.exe	67
PID 908 wrote to memory of 1200	908	cmd.exe	69
PID 908 wrote to memory of 1200	908	cmd.exe	69
PID 908 wrote to memory of 1200	908	cmd.exe	69

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1200	mspaint.exe
1200	mspaint.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

C:\Users\Admin\AppData\Local\Temp\SHRIKESH_CHALLAN.cmd.exe
"C:\Users\Admin\AppData\Local\Temp\SHRIKESH_CHALLAN.cmd.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\RECEIPT.bmp
  2⤵
  - Suspicious use of WriteProcessMemory
  - Modifies registry class
  PID:908
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RECEIPT.bmp"
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious behavior: EnumeratesProcesses
    - Drops file in Windows directory
    PID:1200

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads