Analysis
-
max time kernel
4294180s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
23-03-2022 09:35
Static task
static1
Behavioral task
behavioral1
Sample
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe
Resource
win10v2004-en-20220113
General
-
Target
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe
-
Size
44KB
-
MD5
2e8a0f866db9089197a7ce653a31d8a4
-
SHA1
a3d5131211641e9b5571e84a30f0315600714520
-
SHA256
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2
-
SHA512
b1cb633c21a98d545252beb848370145b028dc8e7c7096c93c7cbb64a2087e7d29daba180b0b2386b884b914884c54b811052668d1d7e5b86e8c9eec830574ed
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid Process 1796 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 2016 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid Process 1932 cmd.exe 1932 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.execmd.execmd.execmd.exedescription pid Process procid_target PID 576 wrote to memory of 1948 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 27 PID 576 wrote to memory of 1948 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 27 PID 576 wrote to memory of 1948 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 27 PID 576 wrote to memory of 1948 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 27 PID 576 wrote to memory of 1932 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 28 PID 576 wrote to memory of 1932 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 28 PID 576 wrote to memory of 1932 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 28 PID 576 wrote to memory of 1932 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 28 PID 576 wrote to memory of 2016 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 30 PID 576 wrote to memory of 2016 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 30 PID 576 wrote to memory of 2016 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 30 PID 576 wrote to memory of 2016 576 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 30 PID 1948 wrote to memory of 856 1948 cmd.exe 33 PID 1948 wrote to memory of 856 1948 cmd.exe 33 PID 1948 wrote to memory of 856 1948 cmd.exe 33 PID 1948 wrote to memory of 856 1948 cmd.exe 33 PID 1932 wrote to memory of 1796 1932 cmd.exe 34 PID 1932 wrote to memory of 1796 1932 cmd.exe 34 PID 1932 wrote to memory of 1796 1932 cmd.exe 34 PID 1932 wrote to memory of 1796 1932 cmd.exe 34 PID 2016 wrote to memory of 2020 2016 cmd.exe 35 PID 2016 wrote to memory of 2020 2016 cmd.exe 35 PID 2016 wrote to memory of 2020 2016 cmd.exe 35 PID 2016 wrote to memory of 2020 2016 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe"C:\Users\Admin\AppData\Local\Temp\c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:856
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:1796
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2020
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
66263a574d94707622190cb95165195c
SHA1e3a0cbdb9befdf5fa36c6be50a08372e9764ccf6
SHA25693346a1a2b990c5ce260dfa30dd00b435e0b71f249039f3056f61d7958c54d03
SHA5123545d0d7c57d9767d2d3828bf649dd0ef02c8a1b57b427fb8bdf79f718842a16c1c2d9ea93159e68ca64405e408886ca719a08f1f37ed4b97ee3cde9524daf8a
-
MD5
66263a574d94707622190cb95165195c
SHA1e3a0cbdb9befdf5fa36c6be50a08372e9764ccf6
SHA25693346a1a2b990c5ce260dfa30dd00b435e0b71f249039f3056f61d7958c54d03
SHA5123545d0d7c57d9767d2d3828bf649dd0ef02c8a1b57b427fb8bdf79f718842a16c1c2d9ea93159e68ca64405e408886ca719a08f1f37ed4b97ee3cde9524daf8a
-
MD5
66263a574d94707622190cb95165195c
SHA1e3a0cbdb9befdf5fa36c6be50a08372e9764ccf6
SHA25693346a1a2b990c5ce260dfa30dd00b435e0b71f249039f3056f61d7958c54d03
SHA5123545d0d7c57d9767d2d3828bf649dd0ef02c8a1b57b427fb8bdf79f718842a16c1c2d9ea93159e68ca64405e408886ca719a08f1f37ed4b97ee3cde9524daf8a
-
MD5
66263a574d94707622190cb95165195c
SHA1e3a0cbdb9befdf5fa36c6be50a08372e9764ccf6
SHA25693346a1a2b990c5ce260dfa30dd00b435e0b71f249039f3056f61d7958c54d03
SHA5123545d0d7c57d9767d2d3828bf649dd0ef02c8a1b57b427fb8bdf79f718842a16c1c2d9ea93159e68ca64405e408886ca719a08f1f37ed4b97ee3cde9524daf8a