Analysis

  • max time kernel
    131s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2022 21:53

General

  • Target

    8663065642d13538e273fca49306870dbaa442e0fff3a116c543b8bcb29917ad.exe

  • Size

    522KB

  • MD5

    68873bff425cb7c2b4d35334ac8722de

  • SHA1

    35b70e20281ed1a405e88b782e3b303dbc31d9d2

  • SHA256

    8663065642d13538e273fca49306870dbaa442e0fff3a116c543b8bcb29917ad

  • SHA512

    4fd7f32cda2f97456212687cc29a8c696268472488f5dbfe23a8d864c959ff666577f32d3981237e75671f3a19aeec39c599dd0b8a0b7433f14464060e39bdd3

  • SSDEEP

    1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8663065642d13538e273fca49306870dbaa442e0fff3a116c543b8bcb29917ad.exe
    "C:\Users\Admin\AppData\Local\Temp\8663065642d13538e273fca49306870dbaa442e0fff3a116c543b8bcb29917ad.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\$$$$$.bat
      2⤵
        PID:5088

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\$$$$$.bat

      Filesize

      264B

      MD5

      380fe6c6241436498340f07459670c7f

      SHA1

      2176ee9644058b7fc41436c2ced575cf08c60c8e

      SHA256

      370b9061c28f7fe0918b248ae7e61819ad21adbd752b2d560f8561251697896c

      SHA512

      84c10af00c45a690392f5d8e64d206ec86979210104491840aed46d0fbf4588107b1dc7c538540914a45acc2ec698b0d2abe01c46331d8d386eb222329c8affc

    • memory/1868-132-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1868-133-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1868-135-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/5088-134-0x0000000000000000-mapping.dmp