Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22-09-2021 20:59
General
-
Target
????????????MV.cmd.exe
-
Size
2.0MB
-
MD5
0889ac4ebfcc906fa3dc17f3a97862da
-
SHA1
dcf4239b4535a3bc4a2a83fadab113984421d086
-
SHA256
07ebb19e273995bef00aa19ad538b5cacb5eb0527288c3f5a31be66bfc1d9bb9
-
SHA512
419d4c89cd9607e2140b0f1eb49c47ed2a0998d40777914bf5b443e5c6906da875407f769b286da390b36f19fcdd9411dd0b6583e3513d1460d3e11533e45bf3
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet Payload 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\____________MV.cmd.exe"C:\Users\Admin\AppData\Local\Temp\____________MV.cmd.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB