Analysis
-
max time kernel
176s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:46
Static task
static1
Behavioral task
behavioral1
Sample
d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34.exe
Resource
win10v2004-20221111-en
General
-
Target
d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34.exe
-
Size
138KB
-
MD5
5bcaa9ea86e49f7da3615a5663797b6f
-
SHA1
b29a79a89d5aec764da4de93b26aec2d37e52083
-
SHA256
d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34
-
SHA512
5c73abf6e892636dc13e86a882484919cd6701fabded4629045f2e92392d48852a62e9e5c3d8abf720d394d23c86713b6e5ad5290163b59aa71563b5a941db40
-
SSDEEP
3072:Mydp70Kw0Kgp+33pDmaO+0PDGSXU3HvGG:TdN0sgmnPUXvGG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
hkcmd.exepid process 220 hkcmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34.exehkcmd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hkcmd = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\hkcmd.exe" d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hkcmd = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\hkcmd.exe" hkcmd.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
hkcmd.exepid process 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe 220 hkcmd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34.exedescription pid process target process PID 1268 wrote to memory of 220 1268 d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34.exe hkcmd.exe PID 1268 wrote to memory of 220 1268 d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34.exe hkcmd.exe PID 1268 wrote to memory of 220 1268 d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34.exe hkcmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34.exe"C:\Users\Admin\AppData\Local\Temp\d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\hkcmd.exe"C:\Users\Admin\AppData\Roaming\Install\hkcmd.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Install\hkcmd.exeFilesize
138KB
MD55bcaa9ea86e49f7da3615a5663797b6f
SHA1b29a79a89d5aec764da4de93b26aec2d37e52083
SHA256d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34
SHA5125c73abf6e892636dc13e86a882484919cd6701fabded4629045f2e92392d48852a62e9e5c3d8abf720d394d23c86713b6e5ad5290163b59aa71563b5a941db40
-
C:\Users\Admin\AppData\Roaming\Install\hkcmd.exeFilesize
138KB
MD55bcaa9ea86e49f7da3615a5663797b6f
SHA1b29a79a89d5aec764da4de93b26aec2d37e52083
SHA256d4339e45d722343773958d7f893c26126b29c0efef48be926be982f1e5918b34
SHA5125c73abf6e892636dc13e86a882484919cd6701fabded4629045f2e92392d48852a62e9e5c3d8abf720d394d23c86713b6e5ad5290163b59aa71563b5a941db40
-
C:\Users\Admin\AppData\Roaming\Install\ntfs.datFilesize
8B
MD5a772ae1e14d74ef501703beb3957e749
SHA1a5f5fec3b412bae3ffae86a0ad8b432711f5e745
SHA2569b354cdfb46c6e94e219cee4a31bf281c0aa29c13be49cd7ec9e98e1aa889778
SHA512b63558b8f1ff1a1c9a00a542c944ad5d8647e666161515259c1f8d2d3ad7aed488c6a11c66c64cc8ab8df08c172b18f3536687c57113c180c0ead71555cbb9a8
-
memory/220-133-0x0000000000000000-mapping.dmp
-
memory/220-137-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/220-139-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1268-132-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1268-138-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1268-140-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB