Analysis

  • max time kernel
    97s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 05:40

General

  • Target

    ff049dbf98cd1dc56f66db435d70bb079e58cbcc7c06437c3d49eef2819cccbf.exe

  • Size

    528KB

  • MD5

    a2961c8984eaf47291cb33ff72afa680

  • SHA1

    b17503d605b042ab91a0cbaa87c1c572f9373271

  • SHA256

    ff049dbf98cd1dc56f66db435d70bb079e58cbcc7c06437c3d49eef2819cccbf

  • SHA512

    7ceb4a37731449aa22c3ea05b48411a8a22809d65d76e217b7962e3e7b0a540b8df5385a11a010c642d475dc631aebacf16c4acf999202dfbf26d46887dbc9da

  • SSDEEP

    1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff049dbf98cd1dc56f66db435d70bb079e58cbcc7c06437c3d49eef2819cccbf.exe
    "C:\Users\Admin\AppData\Local\Temp\ff049dbf98cd1dc56f66db435d70bb079e58cbcc7c06437c3d49eef2819cccbf.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4932
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\$$$$$.bat
      2⤵
        PID:1012

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\$$$$$.bat

      Filesize

      264B

      MD5

      bd87c4d103c96efed3f80200443e8746

      SHA1

      da714568304a4e39a145c2f42f58e61152daf6f5

      SHA256

      3f1449ceb8acda27d2a2a40e4a7c776e3bacde47abbabcf9956560fd9aed9f92

      SHA512

      9312ce431d50507e5b67db218d3710dd51dc98c909d6aef13be7dd3666581594cf788c08f28143a6f10a5e619eece2e7bc6b114dea3881fd2dce96cba53c3d87

    • memory/4932-132-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4932-133-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4932-135-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB