Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
23-03-2022 09:35
Static task
static1
Behavioral task
behavioral1
Sample
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe
Resource
win10v2004-en-20220113
General
-
Target
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe
-
Size
44KB
-
MD5
2e8a0f866db9089197a7ce653a31d8a4
-
SHA1
a3d5131211641e9b5571e84a30f0315600714520
-
SHA256
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2
-
SHA512
b1cb633c21a98d545252beb848370145b028dc8e7c7096c93c7cbb64a2087e7d29daba180b0b2386b884b914884c54b811052668d1d7e5b86e8c9eec830574ed
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid Process 3976 MediaCenter.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.execmd.execmd.execmd.exedescription pid Process procid_target PID 1996 wrote to memory of 2552 1996 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 79 PID 1996 wrote to memory of 2552 1996 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 79 PID 1996 wrote to memory of 2552 1996 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 79 PID 1996 wrote to memory of 2728 1996 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 80 PID 1996 wrote to memory of 2728 1996 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 80 PID 1996 wrote to memory of 2728 1996 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 80 PID 1996 wrote to memory of 2756 1996 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 82 PID 1996 wrote to memory of 2756 1996 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 82 PID 1996 wrote to memory of 2756 1996 c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe 82 PID 2756 wrote to memory of 5056 2756 cmd.exe 85 PID 2756 wrote to memory of 5056 2756 cmd.exe 85 PID 2756 wrote to memory of 5056 2756 cmd.exe 85 PID 2552 wrote to memory of 4468 2552 cmd.exe 86 PID 2552 wrote to memory of 4468 2552 cmd.exe 86 PID 2552 wrote to memory of 4468 2552 cmd.exe 86 PID 2728 wrote to memory of 3976 2728 cmd.exe 87 PID 2728 wrote to memory of 3976 2728 cmd.exe 87 PID 2728 wrote to memory of 3976 2728 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe"C:\Users\Admin\AppData\Local\Temp\c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4468
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:3976
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\c282d35f4f5b6476fa15a710062b76ac2f74c73c4228fc5448e52618a8cb18a2.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:5056
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
8ed2017c2afac40e15d7d46e88ae3345
SHA14ac674621193ade5949a2273544e9bd870be898b
SHA25613312e953f1a9535e0a0cac6173bff39bb421668d6c96a67937a29d2642d2f7a
SHA512a783d554de6adf70ff50484a5c2683a24df9644fd9153c95b876b7c3cd804c09657c60411e3a783a938505ce2a5b691fc1f0b23a45fc9a9be6d38fb4d8b7d576
-
MD5
8ed2017c2afac40e15d7d46e88ae3345
SHA14ac674621193ade5949a2273544e9bd870be898b
SHA25613312e953f1a9535e0a0cac6173bff39bb421668d6c96a67937a29d2642d2f7a
SHA512a783d554de6adf70ff50484a5c2683a24df9644fd9153c95b876b7c3cd804c09657c60411e3a783a938505ce2a5b691fc1f0b23a45fc9a9be6d38fb4d8b7d576