Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2022 21:34
Behavioral task
behavioral1
Sample
e099a64759ca26fd00eab5a428b9754b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e099a64759ca26fd00eab5a428b9754b.exe
Resource
win10v2004-20220812-en
General
-
Target
e099a64759ca26fd00eab5a428b9754b.exe
-
Size
43KB
-
MD5
e099a64759ca26fd00eab5a428b9754b
-
SHA1
0b7dc4c4db22998bdcb6727710a83bb05ada94cf
-
SHA256
6bef3daf882386d3d6e0b06e4e55675dd0f5f7afebfa0056551b7f9cf9a48c90
-
SHA512
f0dd54098f27598f91d0462c4bf42e573d008a0de08266927fcba21c79768e8cba101af40f5adaa95dc313b77e4a8ccf94cef41b200b0d520e16986d240be973
-
SSDEEP
384:MnyhSksAVndb4G3w2NMsG9OqvhyY3Q6oVxYwwsRhg7+iXXRodY6kLdAeMa:1hSksandb4GgyMsp4hyYtoVxYdT7ZXqC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4572 MediaCenter.exe -
Processes:
resource yara_rule behavioral2/memory/1184-132-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/1184-136-0x0000000000400000-0x000000000040D000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral2/memory/4572-142-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/4572-143-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
e099a64759ca26fd00eab5a428b9754b.execmd.execmd.execmd.exedescription pid process target process PID 1184 wrote to memory of 1644 1184 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 1184 wrote to memory of 1644 1184 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 1184 wrote to memory of 1644 1184 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 1184 wrote to memory of 1676 1184 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 1184 wrote to memory of 1676 1184 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 1184 wrote to memory of 1676 1184 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 1184 wrote to memory of 1396 1184 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 1184 wrote to memory of 1396 1184 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 1184 wrote to memory of 1396 1184 e099a64759ca26fd00eab5a428b9754b.exe cmd.exe PID 1396 wrote to memory of 4584 1396 cmd.exe PING.EXE PID 1396 wrote to memory of 4584 1396 cmd.exe PING.EXE PID 1396 wrote to memory of 4584 1396 cmd.exe PING.EXE PID 1644 wrote to memory of 4500 1644 cmd.exe reg.exe PID 1644 wrote to memory of 4500 1644 cmd.exe reg.exe PID 1644 wrote to memory of 4500 1644 cmd.exe reg.exe PID 1676 wrote to memory of 4572 1676 cmd.exe MediaCenter.exe PID 1676 wrote to memory of 4572 1676 cmd.exe MediaCenter.exe PID 1676 wrote to memory of 4572 1676 cmd.exe MediaCenter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e099a64759ca26fd00eab5a428b9754b.exe"C:\Users\Admin\AppData\Local\Temp\e099a64759ca26fd00eab5a428b9754b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\e099a64759ca26fd00eab5a428b9754b.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD5032e74979a4bab6fc8a7ad9e2c78b6f9
SHA1efcdf68f6bb15029cfb6d625485940535898a70e
SHA2565dd43a2db6896a05ab89a48224712de23964d648bdc0d993b158ac074cc3e47a
SHA5129b3d8aa5413043127347c41cb9f51000366758250a86a9ce4823bcfbe07fb1b249d06208799e5d89c219a2aca37098caa69bf6772fa4904d20b9947482ba40e6
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD5032e74979a4bab6fc8a7ad9e2c78b6f9
SHA1efcdf68f6bb15029cfb6d625485940535898a70e
SHA2565dd43a2db6896a05ab89a48224712de23964d648bdc0d993b158ac074cc3e47a
SHA5129b3d8aa5413043127347c41cb9f51000366758250a86a9ce4823bcfbe07fb1b249d06208799e5d89c219a2aca37098caa69bf6772fa4904d20b9947482ba40e6
-
memory/1184-132-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1184-136-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1396-135-0x0000000000000000-mapping.dmp
-
memory/1644-133-0x0000000000000000-mapping.dmp
-
memory/1676-134-0x0000000000000000-mapping.dmp
-
memory/4500-138-0x0000000000000000-mapping.dmp
-
memory/4572-139-0x0000000000000000-mapping.dmp
-
memory/4572-142-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/4572-143-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/4584-137-0x0000000000000000-mapping.dmp