cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17

Analysis

max time kernel
151s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
Size 815KB
Sample221106-3ey4esffd7
SHA256 cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17
MD5 1056301c89aec5bddfeaa3ea47c22310
SHA1 2b835c064ed4c5b1f98375ee9fe4a525b5cee0cc
SHA512 f9ebf4bfdf6494bc8746e0bb1b16c087f90dbf9727083c8a6e7334f98751fafa9e41d523b7647b5cbbc6f85cf140a8a1becb9882014f36fe37f199f282b045a3
SSDEEP 24576:dDPiBNLxYY3I2PcAa8XejW2olrvUIlwz4lpilhhdg:dDPirKY3I20AtpJZwz4lpilj+
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}\LocalServer32	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe"	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.GHSProtocol	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.GHSProtocol\ = "Embedded Async Pluggable Protocol"	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.GHSProtocol\Clsid\ = "{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}"	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}\ProgID	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}\ProgID\ = "cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.GHSProtocol"	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}\ = "Embedded Async Pluggable Protocol"	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.GHSProtocol\Clsid	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA32E7-B054-4E44-8EFE-C24329CB7D9F}	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3328	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
3052	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
3052	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
3052	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 3052	3328	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe	79
PID 3328 wrote to memory of 3052	3328	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe	79
PID 3328 wrote to memory of 3052	3328	cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe	79

C:\Users\Admin\AppData\Local\Temp\cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
"C:\Users\Admin\AppData\Local\Temp\cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Users\Admin\AppData\Local\Temp\cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe
  "C:\Users\Admin\AppData\Local\Temp\cb4d017ce28a9b6d04ae3c7357c1983c9c989b56449749bf1b06d05939e4fd17.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3052-135-0x0000000000400000-0x00000000005E3000-memory.dmp

Download

memory/3052-136-0x0000000000400000-0x00000000005E3000-memory.dmp

Download

memory/3328-132-0x0000000000400000-0x00000000005E3000-memory.dmp

Download

memory/3328-134-0x0000000000400000-0x00000000005E3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads