Analysis
-
max time kernel
184s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 15:39
Static task
static1
Behavioral task
behavioral1
Sample
ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe
Resource
win10v2004-20220812-en
General
-
Target
ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe
-
Size
75KB
-
MD5
d363188dc492fb8909b46753e0e6aa9b
-
SHA1
bb6949630b5141dce2a9c679d052a2e1e85cd171
-
SHA256
ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e
-
SHA512
08683e2ef9086139264a653c8f1cf5d0b2adc9e12080232b1882ed69c8575e16ac8c894cf2ef0cc8735b93dfc136e2803ec5d5cb4d4c102711ab88b4815682ee
-
SSDEEP
1536:6uWi5q5d7rKY61sZxLo+WtYKBjNOvc5KEsh:b1c5dCY6iZhorOk59sh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 5052 svchost.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
svchost.exeregini.exeregini.exeregini.exeregini.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\x86kernel2 = "c:\\users\\admin\\appdata\\roaming\\79326188\\svchost.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run regini.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run regini.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\x86kernel2 = "c:\\users\\admin\\appdata\\roaming\\79326188\\svchost.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run regini.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run regini.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.execmd.execmd.execmd.exesvchost.exedescription pid process target process PID 1188 wrote to memory of 1296 1188 ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe cmd.exe PID 1188 wrote to memory of 1296 1188 ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe cmd.exe PID 1188 wrote to memory of 1296 1188 ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe cmd.exe PID 1296 wrote to memory of 1624 1296 cmd.exe cmd.exe PID 1296 wrote to memory of 1624 1296 cmd.exe cmd.exe PID 1296 wrote to memory of 1624 1296 cmd.exe cmd.exe PID 1296 wrote to memory of 2216 1296 cmd.exe cacls.exe PID 1296 wrote to memory of 2216 1296 cmd.exe cacls.exe PID 1296 wrote to memory of 2216 1296 cmd.exe cacls.exe PID 1188 wrote to memory of 4872 1188 ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe cmd.exe PID 1188 wrote to memory of 4872 1188 ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe cmd.exe PID 1188 wrote to memory of 4872 1188 ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe cmd.exe PID 4872 wrote to memory of 4848 4872 cmd.exe cmd.exe PID 4872 wrote to memory of 4848 4872 cmd.exe cmd.exe PID 4872 wrote to memory of 4848 4872 cmd.exe cmd.exe PID 4872 wrote to memory of 4884 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 4884 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 4884 4872 cmd.exe cacls.exe PID 1188 wrote to memory of 4816 1188 ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe cmd.exe PID 1188 wrote to memory of 4816 1188 ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe cmd.exe PID 1188 wrote to memory of 4816 1188 ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe cmd.exe PID 4816 wrote to memory of 5052 4816 cmd.exe svchost.exe PID 4816 wrote to memory of 5052 4816 cmd.exe svchost.exe PID 4816 wrote to memory of 5052 4816 cmd.exe svchost.exe PID 5052 wrote to memory of 5048 5052 svchost.exe regini.exe PID 5052 wrote to memory of 5048 5052 svchost.exe regini.exe PID 5052 wrote to memory of 5048 5052 svchost.exe regini.exe PID 5052 wrote to memory of 2140 5052 svchost.exe regini.exe PID 5052 wrote to memory of 2140 5052 svchost.exe regini.exe PID 5052 wrote to memory of 2140 5052 svchost.exe regini.exe PID 5052 wrote to memory of 4560 5052 svchost.exe regini.exe PID 5052 wrote to memory of 4560 5052 svchost.exe regini.exe PID 5052 wrote to memory of 4560 5052 svchost.exe regini.exe PID 5052 wrote to memory of 1308 5052 svchost.exe regini.exe PID 5052 wrote to memory of 1308 5052 svchost.exe regini.exe PID 5052 wrote to memory of 1308 5052 svchost.exe regini.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe"C:\Users\Admin\AppData\Local\Temp\ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|CACLS "c:\users\admin\appdata\roaming\79326188\svchost.exe" /P "Admin:R"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "c:\users\admin\appdata\roaming\79326188\svchost.exe" /P "Admin:R"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|CACLS "c:\users\admin\appdata\roaming\79326188" /P "Admin:R"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "c:\users\admin\appdata\roaming\79326188" /P "Admin:R"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Roaming\79326188\svchost.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\79326188\svchost.exeC:\Users\Admin\AppData\Roaming\79326188\svchost.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regini.exeregini per4⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\regini.exeregini perper4⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\regini.exeregini perperper4⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\regini.exeregini perperperper4⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\perFilesize
68B
MD577612e763aacc6671e0c81713b419a41
SHA199c986a0e3bc15532bbca5a18ff90de93fefe7fc
SHA25608f53032b63ada0a816ab77088624bef24a5451b7c7e0de05f958e5bd4e6977b
SHA51299f94d1016eb7bff8deed9eb68c6d26756b2b02a30c4aa5dcc111429e0117acfbc15d7f4119fe06abead5039ee241afc1e6756d2e2250a08fcc818a50598b6cf
-
C:\Users\Admin\AppData\Local\Temp\perperFilesize
68B
MD5a6585d9cf9d692905da3ed6c1b9dd4c1
SHA1166b3aece6d5a7d172acd0a1327af9265a5bf5d4
SHA25650a38aee5de374bab740c163c3debc500041a2ee3aad01d466347eecf2540015
SHA512a402fcebe80023edc9322adeecc89b8df845a80061008c26b890e33636869817460b57a326ee65dcd2bd7275933f9407be96aba7bfeae17530b55985ad00c65c
-
C:\Users\Admin\AppData\Local\Temp\perperperFilesize
67B
MD5e4bcd320585af9f77671cc6e91fe9de6
SHA115f12439eb3e133affb37b29e41e57d89fc90e06
SHA256a1e0f5a9cfc9615222f04e65455c7c4c1ba86710275afffd472428a293c31ec8
SHA51200497885531c0b84fe869828e5f2c0631f2f175f961c62175736487ae703252ba7393f882ffe99d8c4bcdb951172e35daa9ca41f45e64ce97fbae7721b25c112
-
C:\Users\Admin\AppData\Local\Temp\perperperperFilesize
67B
MD558b2f90cc0182925ae0bab51700b14ab
SHA1d2975adeb8dc68f2f5e10edee524de78e79828db
SHA2568114822fe9a58e5ba08abb480dd595109c66a49d9afc404f85843915694c2964
SHA512de6154d3d44c7e332f5cf1f3b1e4f20612ecd37f08fa60382ecc5008af2d9a55216357d6927e706fd2ef60b772e7941631fdfe9b1d615e5264e99cffe59ad782
-
C:\Users\Admin\AppData\Roaming\79326188\svchost.exeFilesize
75KB
MD5d363188dc492fb8909b46753e0e6aa9b
SHA1bb6949630b5141dce2a9c679d052a2e1e85cd171
SHA256ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e
SHA51208683e2ef9086139264a653c8f1cf5d0b2adc9e12080232b1882ed69c8575e16ac8c894cf2ef0cc8735b93dfc136e2803ec5d5cb4d4c102711ab88b4815682ee
-
\??\c:\users\admin\appdata\roaming\79326188\svchost.exeFilesize
75KB
MD5d363188dc492fb8909b46753e0e6aa9b
SHA1bb6949630b5141dce2a9c679d052a2e1e85cd171
SHA256ba8c11ce14def85cbc2e8a7fdb9caae477bcf736e28fc616fd239eb33f0e925e
SHA51208683e2ef9086139264a653c8f1cf5d0b2adc9e12080232b1882ed69c8575e16ac8c894cf2ef0cc8735b93dfc136e2803ec5d5cb4d4c102711ab88b4815682ee
-
memory/1296-132-0x0000000000000000-mapping.dmp
-
memory/1308-148-0x0000000000000000-mapping.dmp
-
memory/1624-133-0x0000000000000000-mapping.dmp
-
memory/2140-144-0x0000000000000000-mapping.dmp
-
memory/2216-134-0x0000000000000000-mapping.dmp
-
memory/4560-146-0x0000000000000000-mapping.dmp
-
memory/4816-139-0x0000000000000000-mapping.dmp
-
memory/4848-137-0x0000000000000000-mapping.dmp
-
memory/4872-136-0x0000000000000000-mapping.dmp
-
memory/4884-138-0x0000000000000000-mapping.dmp
-
memory/5048-142-0x0000000000000000-mapping.dmp
-
memory/5052-140-0x0000000000000000-mapping.dmp