6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649

Analysis

max time kernel
37s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
Size

159KB
MD5

6a09ffdc86f6d9483d9e4c6be8a9a745
SHA1

8b8c3c9f5f892ae3184f47f4cfe874729268e26b
SHA256

6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649
SHA512

8190b5469d907a34e0c40847b6d0f6ed05b52cad1fcfd0102ecfa519829faa2d397aa7774e04aa42988c631c1af421c707337cef27a74fb522229202bd4da412
SSDEEP

3072:uJMnpcMn+WuIX//2kns9Z+ZriYHqYJGBWzcJvHJ/p:K2qWuO2k3zjJGBC4vz

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 984 set thread context of 1152	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	27
PID 984 set thread context of 0	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1152	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
1152	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1152	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	27
PID 984 wrote to memory of 1152	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	27
PID 984 wrote to memory of 1152	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	27
PID 984 wrote to memory of 1152	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	27
PID 984 wrote to memory of 1152	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	27
PID 984 wrote to memory of 1152	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	27
PID 984 wrote to memory of 1152	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	27
PID 984 wrote to memory of 1152	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	27
PID 984 wrote to memory of 0	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
PID 984 wrote to memory of 0	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
PID 984 wrote to memory of 0	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
PID 984 wrote to memory of 0	984	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
PID 1152 wrote to memory of 1412	1152	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	7
PID 1152 wrote to memory of 1412	1152	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	7
PID 1152 wrote to memory of 1412	1152	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	7
PID 1152 wrote to memory of 1412	1152	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	7

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1412
- C:\Users\Admin\AppData\Local\Temp\6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
  "C:\Users\Admin\AppData\Local\Temp\6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Users\Admin\AppData\Local\Temp\6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
    "C:\Users\Admin\AppData\Local\Temp\6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/984-60-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1152-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1152-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1152-62-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1152-66-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1412-63-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download