6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
Size

159KB
MD5

6a09ffdc86f6d9483d9e4c6be8a9a745
SHA1

8b8c3c9f5f892ae3184f47f4cfe874729268e26b
SHA256

6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649
SHA512

8190b5469d907a34e0c40847b6d0f6ed05b52cad1fcfd0102ecfa519829faa2d397aa7774e04aa42988c631c1af421c707337cef27a74fb522229202bd4da412
SSDEEP

3072:uJMnpcMn+WuIX//2kns9Z+ZriYHqYJGBWzcJvHJ/p:K2qWuO2k3zjJGBC4vz

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3128 set thread context of 5036	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	82
PID 3128 set thread context of 0	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5036	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
5036	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
5036	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
5036	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 5036	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	82
PID 3128 wrote to memory of 5036	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	82
PID 3128 wrote to memory of 5036	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	82
PID 3128 wrote to memory of 5036	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	82
PID 3128 wrote to memory of 5036	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	82
PID 3128 wrote to memory of 5036	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	82
PID 3128 wrote to memory of 5036	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	82
PID 3128 wrote to memory of 0	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
PID 3128 wrote to memory of 0	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
PID 3128 wrote to memory of 0	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
PID 3128 wrote to memory of 0	3128	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
PID 5036 wrote to memory of 1076	5036	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	51
PID 5036 wrote to memory of 1076	5036	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	51
PID 5036 wrote to memory of 1076	5036	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	51
PID 5036 wrote to memory of 1076	5036	6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe	51

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1076
- C:\Users\Admin\AppData\Local\Temp\6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
  "C:\Users\Admin\AppData\Local\Temp\6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Users\Admin\AppData\Local\Temp\6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe
    "C:\Users\Admin\AppData\Local\Temp\6c9b2c6db0307d4b8720965ed3cd44572a2f2b58f9d6e0a57c2becd78b025649.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-140-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3128-138-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5036-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5036-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5036-141-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download