Analysis
-
max time kernel
130s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2022 21:35
Behavioral task
behavioral1
Sample
b94c34b47ff7bb61ad8b70f18de510c7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b94c34b47ff7bb61ad8b70f18de510c7.exe
Resource
win10v2004-20220901-en
General
-
Target
b94c34b47ff7bb61ad8b70f18de510c7.exe
-
Size
43KB
-
MD5
b94c34b47ff7bb61ad8b70f18de510c7
-
SHA1
152ba262535deb241a9dbdc004c69a1564ff7803
-
SHA256
6cb97cb356491c601fe9b104bdeeb12351741ab13c77ce335bbb5c4981d13323
-
SHA512
ebfe6ce357802b8a158046144fea2532fceaa0188aceba1be49af365bd93f17ba6a07a7f8ba766a15f9d817832b815d9724509a8cdc67fe9085bb5d31f544dcc
-
SSDEEP
384:MnyhSksAVndb4G3w2NMsG9OqvhyY3Q6oVxYwwsRhg7+iXXRodY6kLdAeMs:1hSksandb4GgyMsp4hyYtoVxYdT7ZXqE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3752 MediaCenter.exe -
Processes:
resource yara_rule behavioral2/memory/3348-135-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/memory/3348-139-0x0000000000400000-0x000000000040D000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
b94c34b47ff7bb61ad8b70f18de510c7.execmd.execmd.execmd.exedescription pid process target process PID 3348 wrote to memory of 396 3348 b94c34b47ff7bb61ad8b70f18de510c7.exe cmd.exe PID 3348 wrote to memory of 396 3348 b94c34b47ff7bb61ad8b70f18de510c7.exe cmd.exe PID 3348 wrote to memory of 396 3348 b94c34b47ff7bb61ad8b70f18de510c7.exe cmd.exe PID 3348 wrote to memory of 2260 3348 b94c34b47ff7bb61ad8b70f18de510c7.exe cmd.exe PID 3348 wrote to memory of 2260 3348 b94c34b47ff7bb61ad8b70f18de510c7.exe cmd.exe PID 3348 wrote to memory of 2260 3348 b94c34b47ff7bb61ad8b70f18de510c7.exe cmd.exe PID 3348 wrote to memory of 1432 3348 b94c34b47ff7bb61ad8b70f18de510c7.exe cmd.exe PID 3348 wrote to memory of 1432 3348 b94c34b47ff7bb61ad8b70f18de510c7.exe cmd.exe PID 3348 wrote to memory of 1432 3348 b94c34b47ff7bb61ad8b70f18de510c7.exe cmd.exe PID 2260 wrote to memory of 3752 2260 cmd.exe MediaCenter.exe PID 2260 wrote to memory of 3752 2260 cmd.exe MediaCenter.exe PID 2260 wrote to memory of 3752 2260 cmd.exe MediaCenter.exe PID 1432 wrote to memory of 4468 1432 cmd.exe PING.EXE PID 1432 wrote to memory of 4468 1432 cmd.exe PING.EXE PID 1432 wrote to memory of 4468 1432 cmd.exe PING.EXE PID 396 wrote to memory of 4440 396 cmd.exe reg.exe PID 396 wrote to memory of 4440 396 cmd.exe reg.exe PID 396 wrote to memory of 4440 396 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b94c34b47ff7bb61ad8b70f18de510c7.exe"C:\Users\Admin\AppData\Local\Temp\b94c34b47ff7bb61ad8b70f18de510c7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\b94c34b47ff7bb61ad8b70f18de510c7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD51aed8064522cf6be4ca5c511322c037f
SHA1960dd569304c70868dc3a5e968c873bfa8bd8168
SHA2560651c0321b93bf70b1ca920fdbe9b25ba1aaaec734249c4afb43dcfc34f3d6f9
SHA512aa5c6596ec1b5a020622820d91332e54e84141a34164fe735dc9763d84a381891af43aa7674b776691e75f4a9180062be79ec616afc7e79e97eb2d198a7d6968
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD51aed8064522cf6be4ca5c511322c037f
SHA1960dd569304c70868dc3a5e968c873bfa8bd8168
SHA2560651c0321b93bf70b1ca920fdbe9b25ba1aaaec734249c4afb43dcfc34f3d6f9
SHA512aa5c6596ec1b5a020622820d91332e54e84141a34164fe735dc9763d84a381891af43aa7674b776691e75f4a9180062be79ec616afc7e79e97eb2d198a7d6968
-
memory/396-136-0x0000000000000000-mapping.dmp
-
memory/1432-138-0x0000000000000000-mapping.dmp
-
memory/2260-137-0x0000000000000000-mapping.dmp
-
memory/3348-135-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/3348-139-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/3752-140-0x0000000000000000-mapping.dmp
-
memory/4440-144-0x0000000000000000-mapping.dmp
-
memory/4468-142-0x0000000000000000-mapping.dmp