dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4

Analysis

max time kernel
99s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2022 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
Size

198KB
MD5

82018436dbd9068b0cd46dc5bfca5f16
SHA1

86f8108e106166d2138d0f87e46a45ef4af11161
SHA256

dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4
SHA512

863ba28a5ad2bed1806a6b3814ea2238b06f350f48fc50ee0f161446b9dbad52761a0c9ea89b611332e7b5c3313ec3fa9ff1355b547b6169cbfd2f98d9cfb9a1
SSDEEP

3072:IJ797h5NGMhjNyHG3396HM0XUGXU2Fo21364EoiJeeI+StSqYLj8MfseRA11UO1h:q797CHenVW5GJZ2tNYLj8Mfsz4V7d0

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 4916	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	80
PID 4944 set thread context of 0	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4916	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
4916	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
4916	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
4916	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4916	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	80
PID 4944 wrote to memory of 4916	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	80
PID 4944 wrote to memory of 4916	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	80
PID 4944 wrote to memory of 4916	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	80
PID 4944 wrote to memory of 4916	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	80
PID 4944 wrote to memory of 4916	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	80
PID 4944 wrote to memory of 4916	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	80
PID 4944 wrote to memory of 0	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
PID 4944 wrote to memory of 0	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
PID 4944 wrote to memory of 0	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
PID 4944 wrote to memory of 0	4944	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
PID 4916 wrote to memory of 3044	4916	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	30
PID 4916 wrote to memory of 3044	4916	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	30
PID 4916 wrote to memory of 3044	4916	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	30
PID 4916 wrote to memory of 3044	4916	dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3044
- C:\Users\Admin\AppData\Local\Temp\dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
  "C:\Users\Admin\AppData\Local\Temp\dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Users\Admin\AppData\Local\Temp\dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe
    "C:\Users\Admin\AppData\Local\Temp\dac3c7a0e28938a2a2c649e6728716c013a02bf67c0913935b43584c26d203a4.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/0-139-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/3044-141-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/4916-135-0x0000000000000000-mapping.dmp

Download
memory/4916-136-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4916-138-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/4916-142-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4944-132-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4944-140-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download