Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
26-03-2022 03:40
Static task
static1
Behavioral task
behavioral1
Sample
962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe
Resource
win10v2004-en-20220113
General
-
Target
962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe
-
Size
42KB
-
MD5
0df6396e7775f62dba90ff08a846cc34
-
SHA1
6bbc28cd80acc12f222c45b8ab93a7b34f0d6b48
-
SHA256
962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f
-
SHA512
7f46b8d2b8f0281d249e626c9e1dcbffe1b8054ea926e3bbb53cceb029d40843a33c986bc6d17ebbec992b395cf288e2b61e37a3d42036eef9c5f1521e24c2df
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid Process 3440 MediaCenter.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.execmd.execmd.execmd.exedescription pid Process procid_target PID 4720 wrote to memory of 5096 4720 962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe 82 PID 4720 wrote to memory of 5096 4720 962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe 82 PID 4720 wrote to memory of 5096 4720 962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe 82 PID 4720 wrote to memory of 4316 4720 962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe 83 PID 4720 wrote to memory of 4316 4720 962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe 83 PID 4720 wrote to memory of 4316 4720 962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe 83 PID 4720 wrote to memory of 3720 4720 962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe 87 PID 4720 wrote to memory of 3720 4720 962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe 87 PID 4720 wrote to memory of 3720 4720 962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe 87 PID 3720 wrote to memory of 4672 3720 cmd.exe 89 PID 5096 wrote to memory of 560 5096 cmd.exe 88 PID 3720 wrote to memory of 4672 3720 cmd.exe 89 PID 5096 wrote to memory of 560 5096 cmd.exe 88 PID 3720 wrote to memory of 4672 3720 cmd.exe 89 PID 5096 wrote to memory of 560 5096 cmd.exe 88 PID 4316 wrote to memory of 3440 4316 cmd.exe 90 PID 4316 wrote to memory of 3440 4316 cmd.exe 90 PID 4316 wrote to memory of 3440 4316 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe"C:\Users\Admin\AppData\Local\Temp\962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:560
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:3440
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4672
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c81ab6ef72b6160928df060288c96774
SHA14536573fd5b7a19580a8d107aba51b88337bb4c3
SHA256167f30bd9f16acffd8de9ae258710d2383aed2a72589fc30d6935387feb8a23f
SHA512728d04a9bc932383d3c687c37eb7dee9a3fd7f5be23c1b3d5f826c4079164811b162cb3f8fee77f922cccc119de949d8a659c2e6043134f13f163b1702c225fa
-
MD5
c81ab6ef72b6160928df060288c96774
SHA14536573fd5b7a19580a8d107aba51b88337bb4c3
SHA256167f30bd9f16acffd8de9ae258710d2383aed2a72589fc30d6935387feb8a23f
SHA512728d04a9bc932383d3c687c37eb7dee9a3fd7f5be23c1b3d5f826c4079164811b162cb3f8fee77f922cccc119de949d8a659c2e6043134f13f163b1702c225fa