Analysis
-
max time kernel
127s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-09-2022 19:55
Behavioral task
behavioral1
Sample
bed112b385fa1c816dee97964167fad7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bed112b385fa1c816dee97964167fad7.exe
Resource
win10v2004-20220812-en
General
-
Target
bed112b385fa1c816dee97964167fad7.exe
-
Size
43KB
-
MD5
bed112b385fa1c816dee97964167fad7
-
SHA1
dc76effd41fcf4097e180a418d4ff9b2564b14c5
-
SHA256
b9b4486fce211476beef8da8b0719448514741c0d66241f33c043bfe52921232
-
SHA512
4932e363fcdc7ea814ee26cbddbd03df7dcece4859ba8b9b4a6e8d491dd4dd01db17acd36d368d95546b22cea075bdb6dab6e70433a908f93421be7f7f62c256
-
SSDEEP
384:MnyhSksAVndb4G3w2NMsG9OqvhyY3Q6oVxYwwsRhg7+iXXRodY6kLdAeMJ:1hSksandb4GgyMsp4hyYtoVxYdT7ZXqB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2020 MediaCenter.exe -
Processes:
resource yara_rule behavioral1/memory/864-55-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/864-59-0x0000000000400000-0x000000000040D000-memory.dmp upx \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral1/memory/1676-68-0x0000000000170000-0x000000000017D000-memory.dmp upx behavioral1/memory/1676-70-0x0000000000170000-0x000000000017D000-memory.dmp upx behavioral1/memory/2020-72-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1076 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1676 cmd.exe 1676 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
bed112b385fa1c816dee97964167fad7.execmd.execmd.execmd.exedescription pid process target process PID 864 wrote to memory of 1960 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 864 wrote to memory of 1960 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 864 wrote to memory of 1960 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 864 wrote to memory of 1960 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 864 wrote to memory of 1676 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 864 wrote to memory of 1676 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 864 wrote to memory of 1676 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 864 wrote to memory of 1676 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 864 wrote to memory of 1076 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 864 wrote to memory of 1076 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 864 wrote to memory of 1076 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 864 wrote to memory of 1076 864 bed112b385fa1c816dee97964167fad7.exe cmd.exe PID 1960 wrote to memory of 2032 1960 cmd.exe reg.exe PID 1960 wrote to memory of 2032 1960 cmd.exe reg.exe PID 1960 wrote to memory of 2032 1960 cmd.exe reg.exe PID 1960 wrote to memory of 2032 1960 cmd.exe reg.exe PID 1676 wrote to memory of 2020 1676 cmd.exe MediaCenter.exe PID 1676 wrote to memory of 2020 1676 cmd.exe MediaCenter.exe PID 1676 wrote to memory of 2020 1676 cmd.exe MediaCenter.exe PID 1676 wrote to memory of 2020 1676 cmd.exe MediaCenter.exe PID 1076 wrote to memory of 1772 1076 cmd.exe PING.EXE PID 1076 wrote to memory of 1772 1076 cmd.exe PING.EXE PID 1076 wrote to memory of 1772 1076 cmd.exe PING.EXE PID 1076 wrote to memory of 1772 1076 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\bed112b385fa1c816dee97964167fad7.exe"C:\Users\Admin\AppData\Local\Temp\bed112b385fa1c816dee97964167fad7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\bed112b385fa1c816dee97964167fad7.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD524998c234d2e8f10c9a6ea01b22dac94
SHA1257676214018f04972660ff9d80baaea0c628d08
SHA25604f6ab5b32fad2e3a2d883e856dfee37f8b81a536149f8e0f0f6f95a9d512fc5
SHA512d7d39eb61683dce7c46dd47875e702e59592d765cfc93efab117a1330b8c5f9e00fbc5f7d516da4fe209ef084aafd87252d97a4ec92e4053310f8a20b16046d7
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD524998c234d2e8f10c9a6ea01b22dac94
SHA1257676214018f04972660ff9d80baaea0c628d08
SHA25604f6ab5b32fad2e3a2d883e856dfee37f8b81a536149f8e0f0f6f95a9d512fc5
SHA512d7d39eb61683dce7c46dd47875e702e59592d765cfc93efab117a1330b8c5f9e00fbc5f7d516da4fe209ef084aafd87252d97a4ec92e4053310f8a20b16046d7
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD524998c234d2e8f10c9a6ea01b22dac94
SHA1257676214018f04972660ff9d80baaea0c628d08
SHA25604f6ab5b32fad2e3a2d883e856dfee37f8b81a536149f8e0f0f6f95a9d512fc5
SHA512d7d39eb61683dce7c46dd47875e702e59592d765cfc93efab117a1330b8c5f9e00fbc5f7d516da4fe209ef084aafd87252d97a4ec92e4053310f8a20b16046d7
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
43KB
MD524998c234d2e8f10c9a6ea01b22dac94
SHA1257676214018f04972660ff9d80baaea0c628d08
SHA25604f6ab5b32fad2e3a2d883e856dfee37f8b81a536149f8e0f0f6f95a9d512fc5
SHA512d7d39eb61683dce7c46dd47875e702e59592d765cfc93efab117a1330b8c5f9e00fbc5f7d516da4fe209ef084aafd87252d97a4ec92e4053310f8a20b16046d7
-
memory/864-59-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/864-54-0x0000000076321000-0x0000000076323000-memory.dmpFilesize
8KB
-
memory/864-55-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1076-58-0x0000000000000000-mapping.dmp
-
memory/1676-68-0x0000000000170000-0x000000000017D000-memory.dmpFilesize
52KB
-
memory/1676-71-0x0000000000170000-0x000000000017D000-memory.dmpFilesize
52KB
-
memory/1676-70-0x0000000000170000-0x000000000017D000-memory.dmpFilesize
52KB
-
memory/1676-57-0x0000000000000000-mapping.dmp
-
memory/1676-69-0x0000000000170000-0x000000000017D000-memory.dmpFilesize
52KB
-
memory/1772-65-0x0000000000000000-mapping.dmp
-
memory/1960-56-0x0000000000000000-mapping.dmp
-
memory/2020-64-0x0000000000000000-mapping.dmp
-
memory/2020-72-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/2032-62-0x0000000000000000-mapping.dmp