Analysis

  • max time kernel
    27s
  • max time network
    42s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    01-02-2022 07:24

General

  • Target

    3c1ce75269219a15d338a103c5e5baf8629438d062474a7c11e3792fdcabdf06.exe

  • Size

    717KB

  • MD5

    8301016527149e8eafe47519c00bb8be

  • SHA1

    503c6df6f8c855fef4f8f080c0ff23e5da5c0756

  • SHA256

    3c1ce75269219a15d338a103c5e5baf8629438d062474a7c11e3792fdcabdf06

  • SHA512

    9c2e0dfa51405c9735e458886e6dbdde2d62e5c5a4dec3eeb183b284c3c702ab3fb747ac144683664f1fb20e855cdcdf3ac9e07907fa6eddb2e1e745d2fd6b59

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c1ce75269219a15d338a103c5e5baf8629438d062474a7c11e3792fdcabdf06.exe
    "C:\Users\Admin\AppData\Local\Temp\3c1ce75269219a15d338a103c5e5baf8629438d062474a7c11e3792fdcabdf06.exe"
    1⤵
    • Modifies Internet Explorer settings
    PID:4344
  • C:\Windows\System32\WaaSMedicAgent.exe
    C:\Windows\System32\WaaSMedicAgent.exe 3c065999094959d16c6e51aa3eeba306 QdFWC7rsiE6oT18xQcR8EQ.0.1.0.0.0
    1⤵
      PID:3204

    Network

    • flag-us
      DNS
      settings-win.data.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      settings-win.data.microsoft.com
      IN A
      Response
      settings-win.data.microsoft.com
      IN CNAME
      settingsfd-geo.trafficmanager.net
      settingsfd-geo.trafficmanager.net
      IN A
      51.124.78.146
    • 20.189.173.6:443
      40 B
      1
    • 51.124.78.146:443
      settings-win.data.microsoft.com
      tls, https
      2.6kB
      7.9kB
      15
      13
    • 8.8.8.8:53
      settings-win.data.microsoft.com
      dns
      77 B
      140 B
      1
      1

      DNS Request

      settings-win.data.microsoft.com

      DNS Response

      51.124.78.146

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.