541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219 | Triage

Analysis

max time kernel
51s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15/07/2022, 09:00

Sharing

Report Analysis Logs

General

Target

541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe
Size

6.3MB
MD5

aa4e99b717bcb7e916148a469e69788a
SHA1

42fc554d8442a78a48dc624d3de59ae4515eed6d
SHA256

541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219
SHA512

c6127eb47a24df060e8d81f95dd3fd4d0118b6fefbd38b25e6f23ac11f4ebdd0eecb61ddd79ef0cc9c4e52cdd36e823f99d5be389141f5ac9cead1b95d33f4ca

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe

Runs net.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 848	4740	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe	87
PID 4740 wrote to memory of 848	4740	541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe	87
PID 848 wrote to memory of 4824	848	cmd.exe	88
PID 848 wrote to memory of 4824	848	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe
"C:\Users\Admin\AppData\Local\Temp\541825cb652606c2ea12fd25a842a8b3456d025841c3a7f563655ef77bb67219.bin.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\system32\cmd.exe
  cmd /C "net use \\10.10.3.42\c$ 23AS32df21 /user:adm-karsair"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\system32\net.exe
    net use \\10.10.3.42\c$ 23AS32df21 /user:adm-karsair
    3⤵
    PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads