Analysis
-
max time kernel
281s -
max time network
301s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
22-02-2022 13:18
Static task
static1
Behavioral task
behavioral1
Sample
6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe
Resource
win10v2004-en-20220113
General
-
Target
6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe
-
Size
77KB
-
MD5
a9fa03b0ee47e03796efe60d4186c484
-
SHA1
52e788cac7568f07868f2a63e856baa19b5671c0
-
SHA256
6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc
-
SHA512
8e149c5568a22a2e18b37d7895465430bdf0af532fdba80a704c0f8eb52645162d880bf9322e8af0c9002e892f3b93e96c0ef103ce5044c449756c5d4834064d
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2976 MediaCenter.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.execmd.execmd.execmd.exedescription pid process target process PID 2032 wrote to memory of 2776 2032 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe cmd.exe PID 2032 wrote to memory of 2776 2032 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe cmd.exe PID 2032 wrote to memory of 2776 2032 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe cmd.exe PID 2032 wrote to memory of 2764 2032 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe cmd.exe PID 2032 wrote to memory of 2764 2032 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe cmd.exe PID 2032 wrote to memory of 2764 2032 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe cmd.exe PID 2032 wrote to memory of 2784 2032 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe cmd.exe PID 2032 wrote to memory of 2784 2032 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe cmd.exe PID 2032 wrote to memory of 2784 2032 6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe cmd.exe PID 2776 wrote to memory of 3148 2776 cmd.exe reg.exe PID 2776 wrote to memory of 3148 2776 cmd.exe reg.exe PID 2776 wrote to memory of 3148 2776 cmd.exe reg.exe PID 2784 wrote to memory of 3312 2784 cmd.exe PING.EXE PID 2784 wrote to memory of 3312 2784 cmd.exe PING.EXE PID 2784 wrote to memory of 3312 2784 cmd.exe PING.EXE PID 2764 wrote to memory of 2976 2764 cmd.exe MediaCenter.exe PID 2764 wrote to memory of 2976 2764 cmd.exe MediaCenter.exe PID 2764 wrote to memory of 2976 2764 cmd.exe MediaCenter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe"C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\6feeea94219e2b7ffd3837d784201bf28ffd7bc83706401bf656550485d899cc.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
8dfc468a34e6b97561d36dfdecfa5c11
SHA1f8e7281c62dfa7d6ef5eae4198b300d0082a1360
SHA256323a9886e675abd2d85c55038d8228a6a4871c7a691fb334acae2b976817cad2
SHA5125c9fe0eeaaabfcc67e8d9078ef86a06dafc3600423cdd9d0f7fe6481c97b6ac695147d6500ea68631959d34ea01c4fad6539db195877e9075bcb0e5dff3bd4a3
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
8dfc468a34e6b97561d36dfdecfa5c11
SHA1f8e7281c62dfa7d6ef5eae4198b300d0082a1360
SHA256323a9886e675abd2d85c55038d8228a6a4871c7a691fb334acae2b976817cad2
SHA5125c9fe0eeaaabfcc67e8d9078ef86a06dafc3600423cdd9d0f7fe6481c97b6ac695147d6500ea68631959d34ea01c4fad6539db195877e9075bcb0e5dff3bd4a3
-
memory/2032-115-0x0000000000401000-0x0000000000404000-memory.dmpFilesize
12KB