Analysis

  • max time kernel
    188s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 04:04

General

  • Target

    06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe

  • Size

    504KB

  • MD5

    07d3c56b6b3cce9d9a68db7e4c617880

  • SHA1

    117d461c18f4c30e6fd2d0800b1d8de6495a9b74

  • SHA256

    06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5

  • SHA512

    b850cc91e65dab9611934df5244cb46777737a4e24f45bb4e5d7678fc547e97f76d600aca6fb6849b4e204a72bd9ba83849aa5350138a89ae55a907a5b99c1b9

  • SSDEEP

    3072:pePKhyMjEchPDbFZdP3qsK0Z8QlVr63Kt4uNA8ktw/FJBItbuS:gPKJv9DbFZdCsKg8SVAKtVSVeF/yL

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe
    "C:\Users\Admin\AppData\Local\Temp\06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Users\Admin\system32.exe
      C:\Users\Admin\system32.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetWindowsHookEx
      PID:1480

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\System32.exe

    Filesize

    504KB

    MD5

    08b9bbaf9ff6a37fc9949cbba5ebd7c2

    SHA1

    9dd5cf4768239de04d822dd3d0be129a92e71bc8

    SHA256

    b6dc0b5ae7c39ad852455b5426605d7f58cb0b4f58b79c01d8cfd84a65f378fd

    SHA512

    d468ec6254d8c51085ee2277ad1a40dc335e71dc99378e6319bf13ccf2b8a92baf4a64b7f9ba04eed82ac7fe7439d49caa2240b6f167fa8310eec6fcbe5fc302

  • C:\Users\Admin\system32.exe

    Filesize

    504KB

    MD5

    08b9bbaf9ff6a37fc9949cbba5ebd7c2

    SHA1

    9dd5cf4768239de04d822dd3d0be129a92e71bc8

    SHA256

    b6dc0b5ae7c39ad852455b5426605d7f58cb0b4f58b79c01d8cfd84a65f378fd

    SHA512

    d468ec6254d8c51085ee2277ad1a40dc335e71dc99378e6319bf13ccf2b8a92baf4a64b7f9ba04eed82ac7fe7439d49caa2240b6f167fa8310eec6fcbe5fc302

  • memory/1480-140-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/1480-142-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/3080-132-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB

  • memory/3080-141-0x0000000000400000-0x0000000000492000-memory.dmp

    Filesize

    584KB