Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
23-03-2022 09:35
Static task
static1
Behavioral task
behavioral1
Sample
6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe
Resource
win10v2004-en-20220113
General
-
Target
6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe
-
Size
44KB
-
MD5
bd0c5a300f38dbcd5df55edc20426bd6
-
SHA1
fd8cfb0e3fa32b42ccbffc4c0dd8f1ab94896358
-
SHA256
6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630
-
SHA512
c2d0d1d34a187e72522708de4ada0e3bc38e1d0983d76078af760f6689f58827e355411365d593d63bf027b05714badc2302e40a0345f49254811a096d7f5fe9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid Process 4572 MediaCenter.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.execmd.execmd.execmd.exedescription pid Process procid_target PID 1652 wrote to memory of 2164 1652 6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe 80 PID 1652 wrote to memory of 2164 1652 6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe 80 PID 1652 wrote to memory of 2164 1652 6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe 80 PID 1652 wrote to memory of 2348 1652 6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe 81 PID 1652 wrote to memory of 2348 1652 6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe 81 PID 1652 wrote to memory of 2348 1652 6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe 81 PID 1652 wrote to memory of 2384 1652 6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe 83 PID 1652 wrote to memory of 2384 1652 6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe 83 PID 1652 wrote to memory of 2384 1652 6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe 83 PID 2384 wrote to memory of 4800 2384 cmd.exe 86 PID 2384 wrote to memory of 4800 2384 cmd.exe 86 PID 2384 wrote to memory of 4800 2384 cmd.exe 86 PID 2164 wrote to memory of 4292 2164 cmd.exe 87 PID 2164 wrote to memory of 4292 2164 cmd.exe 87 PID 2164 wrote to memory of 4292 2164 cmd.exe 87 PID 2348 wrote to memory of 4572 2348 cmd.exe 88 PID 2348 wrote to memory of 4572 2348 cmd.exe 88 PID 2348 wrote to memory of 4572 2348 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe"C:\Users\Admin\AppData\Local\Temp\6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4292
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:4572
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\6699ed985b80cf027b8ac2e914cbe85e97d2ba27962aad45c0f128eece97e630.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4800
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
ca29936dfe408e3650b97cecfd5f050d
SHA188f82b90bb3e52d18fd6f22300c52306f6fa53fa
SHA256a0bf6516267ef25808f436bd1755cb224dd09afe59a93c326dfce2ba359b23f2
SHA512d747ca19c3284d36d70187d2fea99e109e16a88216cec24472ee857a74502245fc33ecb944e26d2dcef2e0506d687a07da436fc57e175f00655c5d5a468ccd84
-
MD5
ca29936dfe408e3650b97cecfd5f050d
SHA188f82b90bb3e52d18fd6f22300c52306f6fa53fa
SHA256a0bf6516267ef25808f436bd1755cb224dd09afe59a93c326dfce2ba359b23f2
SHA512d747ca19c3284d36d70187d2fea99e109e16a88216cec24472ee857a74502245fc33ecb944e26d2dcef2e0506d687a07da436fc57e175f00655c5d5a468ccd84