Analysis
-
max time kernel
142s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 14:13
Behavioral task
behavioral1
Sample
92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe
Resource
win10v2004-20220812-en
General
-
Target
92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe
-
Size
116KB
-
MD5
d33e93943940e960cd1d2232c86e5176
-
SHA1
ee751b056483a29a81b55d27aa1a1881cd892a4b
-
SHA256
92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03
-
SHA512
60fdb6c488d31899cf5fe64a1dbb5838a0b05306faffbb279629be9f6d3fb5afdb889eef92c80a61cf3df6f2acdd3aa3582913b0dc6d6cb47525ed5447b69925
-
SSDEEP
1536:p4Lmcw5Kfd+KLHNEvpzmRNAHTvRQ1h5DKTQaAzVGSqleySq8smztlOT:pmmD5Md+KLHMuNCQn5DzMDlGq8PztlO
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\winms = "C:\\Users\\Admin\\AppData\\Roaming\\winms.exe" reg.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exedescription pid process target process PID 1228 wrote to memory of 1812 1228 92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe reg.exe PID 1228 wrote to memory of 1812 1228 92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe reg.exe PID 1228 wrote to memory of 1812 1228 92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe reg.exe PID 1228 wrote to memory of 1812 1228 92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe reg.exe PID 1228 wrote to memory of 2020 1228 92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe cmd.exe PID 1228 wrote to memory of 2020 1228 92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe cmd.exe PID 1228 wrote to memory of 2020 1228 92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe cmd.exe PID 1228 wrote to memory of 2020 1228 92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe"C:\Users\Admin\AppData\Local\Temp\92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v winms /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winms.exe"2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c copy "C:\Users\Admin\AppData\Local\Temp\92449ccf090ef16697a226419edf724b138ee7eb12380bade16706d8dd056b03.exe" "C:\Users\Admin\AppData\Roaming\winms.exe"2⤵