Analysis
-
max time kernel
188s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 04:04
Static task
static1
Behavioral task
behavioral1
Sample
06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe
Resource
win10v2004-20220812-en
General
-
Target
06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe
-
Size
504KB
-
MD5
07d3c56b6b3cce9d9a68db7e4c617880
-
SHA1
117d461c18f4c30e6fd2d0800b1d8de6495a9b74
-
SHA256
06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5
-
SHA512
b850cc91e65dab9611934df5244cb46777737a4e24f45bb4e5d7678fc547e97f76d600aca6fb6849b4e204a72bd9ba83849aa5350138a89ae55a907a5b99c1b9
-
SSDEEP
3072:pePKhyMjEchPDbFZdP3qsK0Z8QlVr63Kt4uNA8ktw/FJBItbuS:gPKJv9DbFZdCsKg8SVAKtVSVeF/yL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1480 system32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ system32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\system32.exe" system32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3080 06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe 1480 system32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3080 wrote to memory of 1480 3080 06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe 81 PID 3080 wrote to memory of 1480 3080 06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe 81 PID 3080 wrote to memory of 1480 3080 06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe"C:\Users\Admin\AppData\Local\Temp\06f4fb4c2f7e0a0ae482da1ed98cac9f9cc6eab8be25665c6e44d518fd7f74e5.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\system32.exeC:\Users\Admin\system32.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1480
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504KB
MD508b9bbaf9ff6a37fc9949cbba5ebd7c2
SHA19dd5cf4768239de04d822dd3d0be129a92e71bc8
SHA256b6dc0b5ae7c39ad852455b5426605d7f58cb0b4f58b79c01d8cfd84a65f378fd
SHA512d468ec6254d8c51085ee2277ad1a40dc335e71dc99378e6319bf13ccf2b8a92baf4a64b7f9ba04eed82ac7fe7439d49caa2240b6f167fa8310eec6fcbe5fc302
-
Filesize
504KB
MD508b9bbaf9ff6a37fc9949cbba5ebd7c2
SHA19dd5cf4768239de04d822dd3d0be129a92e71bc8
SHA256b6dc0b5ae7c39ad852455b5426605d7f58cb0b4f58b79c01d8cfd84a65f378fd
SHA512d468ec6254d8c51085ee2277ad1a40dc335e71dc99378e6319bf13ccf2b8a92baf4a64b7f9ba04eed82ac7fe7439d49caa2240b6f167fa8310eec6fcbe5fc302