Analysis
-
max time kernel
4294180s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
23-03-2022 09:35
Static task
static1
Behavioral task
behavioral1
Sample
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe
Resource
win10v2004-en-20220113
General
-
Target
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe
-
Size
44KB
-
MD5
2e8a0f866db9089197a7ce653a31d8a4
-
SHA1
a3d5131211641e9b5571e84a30f0315600714520
-
SHA256
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2
-
SHA512
b1cb633c21a98d545252beb848370145b028dc8e7c7096c93c7cbb64a2087e7d29daba180b0b2386b884b914884c54b811052668d1d7e5b86e8c9eec830574ed
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1796 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2016 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1932 cmd.exe 1932 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.execmd.execmd.execmd.exedescription pid process target process PID 576 wrote to memory of 1948 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 576 wrote to memory of 1948 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 576 wrote to memory of 1948 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 576 wrote to memory of 1948 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 576 wrote to memory of 1932 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 576 wrote to memory of 1932 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 576 wrote to memory of 1932 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 576 wrote to memory of 1932 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 576 wrote to memory of 2016 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 576 wrote to memory of 2016 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 576 wrote to memory of 2016 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 576 wrote to memory of 2016 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe cmd.exe PID 1948 wrote to memory of 856 1948 cmd.exe reg.exe PID 1948 wrote to memory of 856 1948 cmd.exe reg.exe PID 1948 wrote to memory of 856 1948 cmd.exe reg.exe PID 1948 wrote to memory of 856 1948 cmd.exe reg.exe PID 1932 wrote to memory of 1796 1932 cmd.exe MediaCenter.exe PID 1932 wrote to memory of 1796 1932 cmd.exe MediaCenter.exe PID 1932 wrote to memory of 1796 1932 cmd.exe MediaCenter.exe PID 1932 wrote to memory of 1796 1932 cmd.exe MediaCenter.exe PID 2016 wrote to memory of 2020 2016 cmd.exe PING.EXE PID 2016 wrote to memory of 2020 2016 cmd.exe PING.EXE PID 2016 wrote to memory of 2020 2016 cmd.exe PING.EXE PID 2016 wrote to memory of 2020 2016 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe"C:\Users\Admin\AppData\Local\Temp\c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
66263a574d94707622190cb95165195c
SHA1e3a0cbdb9befdf5fa36c6be50a08372e9764ccf6
SHA25693346a1a2b990c5ce260dfa30dd00b435e0b71f249039f3056f61d7958c54d03
SHA5123545d0d7c57d9767d2d3828bf649dd0ef02c8a1b57b427fb8bdf79f718842a16c1c2d9ea93159e68ca64405e408886ca719a08f1f37ed4b97ee3cde9524daf8a
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
66263a574d94707622190cb95165195c
SHA1e3a0cbdb9befdf5fa36c6be50a08372e9764ccf6
SHA25693346a1a2b990c5ce260dfa30dd00b435e0b71f249039f3056f61d7958c54d03
SHA5123545d0d7c57d9767d2d3828bf649dd0ef02c8a1b57b427fb8bdf79f718842a16c1c2d9ea93159e68ca64405e408886ca719a08f1f37ed4b97ee3cde9524daf8a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
66263a574d94707622190cb95165195c
SHA1e3a0cbdb9befdf5fa36c6be50a08372e9764ccf6
SHA25693346a1a2b990c5ce260dfa30dd00b435e0b71f249039f3056f61d7958c54d03
SHA5123545d0d7c57d9767d2d3828bf649dd0ef02c8a1b57b427fb8bdf79f718842a16c1c2d9ea93159e68ca64405e408886ca719a08f1f37ed4b97ee3cde9524daf8a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeMD5
66263a574d94707622190cb95165195c
SHA1e3a0cbdb9befdf5fa36c6be50a08372e9764ccf6
SHA25693346a1a2b990c5ce260dfa30dd00b435e0b71f249039f3056f61d7958c54d03
SHA5123545d0d7c57d9767d2d3828bf649dd0ef02c8a1b57b427fb8bdf79f718842a16c1c2d9ea93159e68ca64405e408886ca719a08f1f37ed4b97ee3cde9524daf8a
-
memory/576-54-0x0000000075471000-0x0000000075473000-memory.dmpFilesize
8KB
-
memory/576-58-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/856-61-0x0000000000000000-mapping.dmp
-
memory/1796-63-0x0000000000000000-mapping.dmp
-
memory/1932-56-0x0000000000000000-mapping.dmp
-
memory/1948-55-0x0000000000000000-mapping.dmp
-
memory/2016-57-0x0000000000000000-mapping.dmp
-
memory/2020-64-0x0000000000000000-mapping.dmp