Analysis
-
max time kernel
138s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
23-03-2022 09:35
Static task
static1
Behavioral task
behavioral1
Sample
82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe
Resource
win10v2004-en-20220113
General
-
Target
82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe
-
Size
44KB
-
MD5
c37ff8b3db540a36ae8cdaf672330283
-
SHA1
0be70fcd35c3561d178b35606232046d2b9c656e
-
SHA256
82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c
-
SHA512
2e1710f178487f560cf744ffa8488fde1dab7a8f685c63e77e05f1fe8034f2fbf2bed64daf4859cc57ba1c58ab25ebe191bd96db7ccd9abd58c1e65d8ebbf4be
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4632 MediaCenter.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.execmd.execmd.execmd.exedescription pid process target process PID 1928 wrote to memory of 3568 1928 82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe cmd.exe PID 1928 wrote to memory of 3568 1928 82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe cmd.exe PID 1928 wrote to memory of 3568 1928 82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe cmd.exe PID 1928 wrote to memory of 4708 1928 82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe cmd.exe PID 1928 wrote to memory of 4708 1928 82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe cmd.exe PID 1928 wrote to memory of 4708 1928 82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe cmd.exe PID 1928 wrote to memory of 4712 1928 82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe cmd.exe PID 1928 wrote to memory of 4712 1928 82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe cmd.exe PID 1928 wrote to memory of 4712 1928 82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe cmd.exe PID 3568 wrote to memory of 2928 3568 cmd.exe reg.exe PID 3568 wrote to memory of 2928 3568 cmd.exe reg.exe PID 3568 wrote to memory of 2928 3568 cmd.exe reg.exe PID 4712 wrote to memory of 4608 4712 cmd.exe PING.EXE PID 4712 wrote to memory of 4608 4712 cmd.exe PING.EXE PID 4712 wrote to memory of 4608 4712 cmd.exe PING.EXE PID 4708 wrote to memory of 4632 4708 cmd.exe MediaCenter.exe PID 4708 wrote to memory of 4632 4708 cmd.exe MediaCenter.exe PID 4708 wrote to memory of 4632 4708 cmd.exe MediaCenter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe"C:\Users\Admin\AppData\Local\Temp\82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\82fee0c6b3b147b3127d5395013fa78f1563cf7afadedd762631720c095e912c.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
cc5d547a6d864d58be6b6a3d6647d5e7
SHA139cf078ece8ffd3bcb60ede0e1f90e27bd2062d1
SHA2564b08b4433fa610191cf62e9566cf0557b13fb712d92bc7caa314a9e046e1bc73
SHA512310a6d0823abc5d5bc16b3e0a0cd0c4b7a17db23de390fd78aad914b76957a1b3f87659b5db2c73ce31b1dcc2898f135c38ed90afd800297a3da65a414f9c08c
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
cc5d547a6d864d58be6b6a3d6647d5e7
SHA139cf078ece8ffd3bcb60ede0e1f90e27bd2062d1
SHA2564b08b4433fa610191cf62e9566cf0557b13fb712d92bc7caa314a9e046e1bc73
SHA512310a6d0823abc5d5bc16b3e0a0cd0c4b7a17db23de390fd78aad914b76957a1b3f87659b5db2c73ce31b1dcc2898f135c38ed90afd800297a3da65a414f9c08c
-
memory/1928-133-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2928-134-0x0000000000000000-mapping.dmp
-
memory/3568-130-0x0000000000000000-mapping.dmp
-
memory/4608-135-0x0000000000000000-mapping.dmp
-
memory/4632-136-0x0000000000000000-mapping.dmp
-
memory/4708-131-0x0000000000000000-mapping.dmp
-
memory/4712-132-0x0000000000000000-mapping.dmp