Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-09-2022 21:34
Behavioral task
behavioral1
Sample
e099a64759ca26fd00eab5a428b9754b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e099a64759ca26fd00eab5a428b9754b.exe
Resource
win10v2004-20220812-en
General
-
Target
e099a64759ca26fd00eab5a428b9754b.exe
-
Size
43KB
-
MD5
e099a64759ca26fd00eab5a428b9754b
-
SHA1
0b7dc4c4db22998bdcb6727710a83bb05ada94cf
-
SHA256
6bef3daf882386d3d6e0b06e4e55675dd0f5f7afebfa0056551b7f9cf9a48c90
-
SHA512
f0dd54098f27598f91d0462c4bf42e573d008a0de08266927fcba21c79768e8cba101af40f5adaa95dc313b77e4a8ccf94cef41b200b0d520e16986d240be973
-
SSDEEP
384:MnyhSksAVndb4G3w2NMsG9OqvhyY3Q6oVxYwwsRhg7+iXXRodY6kLdAeMa:1hSksandb4GgyMsp4hyYtoVxYdT7ZXqC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1084 MediaCenter.exe -
Processes:
resource yara_rule behavioral1/memory/240-55-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/240-59-0x0000000000400000-0x000000000040D000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral1/memory/1936-70-0x0000000000160000-0x000000000016D000-memory.dmp upx behavioral1/memory/1084-72-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1428 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1936 cmd.exe 1936 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
e099a64759ca26fd00eab5a428b9754b.execmd.execmd.execmd.exedescription pid process target process PID 240 wrote to memory of 952 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 240 wrote to memory of 952 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 240 wrote to memory of 952 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 240 wrote to memory of 952 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 240 wrote to memory of 1936 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 240 wrote to memory of 1936 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 240 wrote to memory of 1936 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 240 wrote to memory of 1936 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 240 wrote to memory of 1428 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 240 wrote to memory of 1428 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 240 wrote to memory of 1428 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 240 wrote to memory of 1428 240 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 952 wrote to memory of 1112 952 cmd.exe reg.exe PID 952 wrote to memory of 1112 952 cmd.exe reg.exe PID 952 wrote to memory of 1112 952 cmd.exe reg.exe PID 952 wrote to memory of 1112 952 cmd.exe reg.exe PID 1936 wrote to memory of 1084 1936 cmd.exe MediaCenter.exe PID 1936 wrote to memory of 1084 1936 cmd.exe MediaCenter.exe PID 1936 wrote to memory of 1084 1936 cmd.exe MediaCenter.exe PID 1936 wrote to memory of 1084 1936 cmd.exe MediaCenter.exe PID 1428 wrote to memory of 908 1428 cmd.exe PING.EXE PID 1428 wrote to memory of 908 1428 cmd.exe PING.EXE PID 1428 wrote to memory of 908 1428 cmd.exe PING.EXE PID 1428 wrote to memory of 908 1428 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\e099a64759ca26fd00eab5a428b9754b.exe"C:\Users\Admin\AppData\Local\Temp\e099a64759ca26fd00eab5a428b9754b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\e099a64759ca26fd00eab5a428b9754b.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD529017d4c24afa23da3ed2ea198c26193
SHA1e03ceb3ca91d319a28803d7d5a9e72625a04f3f0
SHA256a4fe850c7142abd40e1d1f2ae994d7911630660329c15ed0f6b96325e70234cc
SHA5126bf48ae2ef82ac93e3211dc6f7c374a9725eadf57ebfc4ef28325325c95cd882423b47286f909bb49e5eab0a966af52b526034363a5ce3bc68947a4aea192d05
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD529017d4c24afa23da3ed2ea198c26193
SHA1e03ceb3ca91d319a28803d7d5a9e72625a04f3f0
SHA256a4fe850c7142abd40e1d1f2ae994d7911630660329c15ed0f6b96325e70234cc
SHA5126bf48ae2ef82ac93e3211dc6f7c374a9725eadf57ebfc4ef28325325c95cd882423b47286f909bb49e5eab0a966af52b526034363a5ce3bc68947a4aea192d05
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD529017d4c24afa23da3ed2ea198c26193
SHA1e03ceb3ca91d319a28803d7d5a9e72625a04f3f0
SHA256a4fe850c7142abd40e1d1f2ae994d7911630660329c15ed0f6b96325e70234cc
SHA5126bf48ae2ef82ac93e3211dc6f7c374a9725eadf57ebfc4ef28325325c95cd882423b47286f909bb49e5eab0a966af52b526034363a5ce3bc68947a4aea192d05
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD529017d4c24afa23da3ed2ea198c26193
SHA1e03ceb3ca91d319a28803d7d5a9e72625a04f3f0
SHA256a4fe850c7142abd40e1d1f2ae994d7911630660329c15ed0f6b96325e70234cc
SHA5126bf48ae2ef82ac93e3211dc6f7c374a9725eadf57ebfc4ef28325325c95cd882423b47286f909bb49e5eab0a966af52b526034363a5ce3bc68947a4aea192d05
-
memory/240-55-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/240-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB
-
memory/240-59-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/908-65-0x0000000000000000-mapping.dmp
-
memory/952-56-0x0000000000000000-mapping.dmp
-
memory/1084-64-0x0000000000000000-mapping.dmp
-
memory/1084-72-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1112-60-0x0000000000000000-mapping.dmp
-
memory/1428-58-0x0000000000000000-mapping.dmp
-
memory/1936-57-0x0000000000000000-mapping.dmp
-
memory/1936-68-0x0000000000160000-0x000000000016D000-memory.dmpFilesize
52KB
-
memory/1936-69-0x0000000000160000-0x000000000016D000-memory.dmpFilesize
52KB
-
memory/1936-70-0x0000000000160000-0x000000000016D000-memory.dmpFilesize
52KB
-
memory/1936-71-0x0000000000160000-0x000000000016D000-memory.dmpFilesize
52KB