cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Size

569KB
MD5

90dd3d16665ae94dee0c646531ce8260
SHA1

52752346f9d43f5688ed2ce39064b06d10875844
SHA256

cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d
SHA512

4579db1177c2ce99dee906a11c69dd1f06bd8677cf14f51d1ed6486d3ec32b9abba00618cfb1befa5379aaee16ede86718d931fbb2c218af89bd3d56ed9bcb1c
SSDEEP

6144:BmvP1P0VHSeyvrfllAoX2YDUUhRiDn349VRlpyl+0g:Bm+LClKYDUV4VRX2+0g

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4924 set thread context of 4372	4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe	84

Modifies registry class 55 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\shell\printto	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CBC96B~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\""	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\Verb\0\ = "&Edit,0,2"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\AuxUserType	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\AuxUserType\3	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\protocol\StdFileEditing\server\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CBC96B~1.EXE"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CBC96B~1.EXE,0"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CBC96B~1.EXE /p \"%1\""	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\CLSID\ = "{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\ProgID	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\shell\open	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\Verb\1\ = "&Open,0,2"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\AuxUserType\2	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\MiscStatus	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\MiscStatus\ = "32"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\InprocHandler32\ = "ole32.dll"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CBC96B~1.EXE,0"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\protocol\StdFileEditing	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\protocol\StdFileEditing\verb	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.srv	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\Verb	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\shell\print	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\protocol\StdFileEditing\verb\0	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\protocol	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\ProgID\ = "ServDemo.Document"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\InprocHandler32	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\Insertable\	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CBC96B~1.EXE \"%1\""	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\shell\print\command	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.srv\ = "ServDemo.Document"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\AuxUserType\3\ = "ServDemo"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\shell	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\Insertable	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\shell\printto\command	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.srv\ShellNew\NullFile	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\AuxUserType\2\ = "ServDe"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\CLSID	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\shell\open\command	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.srv\ShellNew	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\ = "ServDe Document"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\Insertable	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\protocol\StdFileEditing\server	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\DefaultIcon	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\ = "ServDe Document"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\Verb\0	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\Verb\1	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\Insertable\	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\LocalServer32	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CBC96B~1.EXE"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03A2EC83-ABBE-11D1-80FC-00C0F6A83B7F}\DefaultIcon	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ServDemo.Document\protocol\StdFileEditing\verb\0\ = "&Edit"	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4372	4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe	84
PID 4924 wrote to memory of 4372	4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe	84
PID 4924 wrote to memory of 4372	4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe	84
PID 4924 wrote to memory of 4372	4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe	84
PID 4924 wrote to memory of 4372	4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe	84
PID 4924 wrote to memory of 4372	4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe	84
PID 4924 wrote to memory of 4372	4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe	84
PID 4924 wrote to memory of 4372	4924	cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe	84

C:\Users\Admin\AppData\Local\Temp\cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
"C:\Users\Admin\AppData\Local\Temp\cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe
  "C:\Users\Admin\AppData\Local\Temp\cbc96b2aa36417240fc880227fd379d66d74071a2b030b9639245469a175360d.exe"
  2⤵
  PID:4372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4372-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4372-138-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4924-132-0x00000000022C0000-0x000000000233B000-memory.dmp

Filesize
492KB

Download
memory/4924-134-0x00000000022C0000-0x000000000233B000-memory.dmp

Filesize
492KB

Download
memory/4924-137-0x00000000022C0000-0x000000000233B000-memory.dmp

Filesize
492KB

Download