Analysis
-
max time kernel
310s -
max time network
417s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 22:36
Static task
static1
Behavioral task
behavioral1
Sample
77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe
Resource
win10v2004-20221111-en
General
-
Target
77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe
-
Size
76KB
-
MD5
c80f556153f4798901692cce450bbb60
-
SHA1
ceffdae200685c6cc6e9f0a71748346e157e86b0
-
SHA256
77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c
-
SHA512
1e4e7a88e5fe217e3c5e80415d11203a192db43814feee4b2d53b107d9047dd37ec491195776ea400ecb92723c464c4d02cac2430c8ea552b5697cd08bc50c4c
-
SSDEEP
768:nu17djCLTWQ+LMmdjjQ4hsMg8jfVjIbdu+KdoJzc5XvHFcoIPwHCO1XSBcb9KEsh:nuzCveYzsFZmboCq5ahO+c5KEsh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 548 svchost.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
svchost.exeregini.exeregini.exeregini.exeregini.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\x86kernel2 = "c:\\users\\admin\\appdata\\roaming\\28803048\\svchost.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run regini.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run regini.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\x86kernel2 = "c:\\users\\admin\\appdata\\roaming\\28803048\\svchost.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run regini.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run regini.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.execmd.execmd.execmd.exesvchost.exedescription pid process target process PID 1248 wrote to memory of 2156 1248 77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe cmd.exe PID 1248 wrote to memory of 2156 1248 77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe cmd.exe PID 1248 wrote to memory of 2156 1248 77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe cmd.exe PID 2156 wrote to memory of 3460 2156 cmd.exe cmd.exe PID 2156 wrote to memory of 3460 2156 cmd.exe cmd.exe PID 2156 wrote to memory of 3460 2156 cmd.exe cmd.exe PID 2156 wrote to memory of 4424 2156 cmd.exe cacls.exe PID 2156 wrote to memory of 4424 2156 cmd.exe cacls.exe PID 2156 wrote to memory of 4424 2156 cmd.exe cacls.exe PID 1248 wrote to memory of 3528 1248 77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe cmd.exe PID 1248 wrote to memory of 3528 1248 77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe cmd.exe PID 1248 wrote to memory of 3528 1248 77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe cmd.exe PID 3528 wrote to memory of 1852 3528 cmd.exe cmd.exe PID 3528 wrote to memory of 1852 3528 cmd.exe cmd.exe PID 3528 wrote to memory of 1852 3528 cmd.exe cmd.exe PID 3528 wrote to memory of 804 3528 cmd.exe cacls.exe PID 3528 wrote to memory of 804 3528 cmd.exe cacls.exe PID 3528 wrote to memory of 804 3528 cmd.exe cacls.exe PID 1248 wrote to memory of 2528 1248 77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe cmd.exe PID 1248 wrote to memory of 2528 1248 77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe cmd.exe PID 1248 wrote to memory of 2528 1248 77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe cmd.exe PID 2528 wrote to memory of 548 2528 cmd.exe svchost.exe PID 2528 wrote to memory of 548 2528 cmd.exe svchost.exe PID 2528 wrote to memory of 548 2528 cmd.exe svchost.exe PID 548 wrote to memory of 4136 548 svchost.exe regini.exe PID 548 wrote to memory of 4136 548 svchost.exe regini.exe PID 548 wrote to memory of 4136 548 svchost.exe regini.exe PID 548 wrote to memory of 2128 548 svchost.exe regini.exe PID 548 wrote to memory of 2128 548 svchost.exe regini.exe PID 548 wrote to memory of 2128 548 svchost.exe regini.exe PID 548 wrote to memory of 2532 548 svchost.exe regini.exe PID 548 wrote to memory of 2532 548 svchost.exe regini.exe PID 548 wrote to memory of 2532 548 svchost.exe regini.exe PID 548 wrote to memory of 32 548 svchost.exe regini.exe PID 548 wrote to memory of 32 548 svchost.exe regini.exe PID 548 wrote to memory of 32 548 svchost.exe regini.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe"C:\Users\Admin\AppData\Local\Temp\77998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|CACLS "c:\users\admin\appdata\roaming\28803048\svchost.exe" /P "Admin:R"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "c:\users\admin\appdata\roaming\28803048\svchost.exe" /P "Admin:R"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|CACLS "c:\users\admin\appdata\roaming\28803048" /P "Admin:R"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "c:\users\admin\appdata\roaming\28803048" /P "Admin:R"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Roaming\28803048\svchost.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\28803048\svchost.exeC:\Users\Admin\AppData\Roaming\28803048\svchost.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regini.exeregini per4⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\regini.exeregini perper4⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\regini.exeregini perperper4⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\regini.exeregini perperperper4⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\perFilesize
68B
MD577612e763aacc6671e0c81713b419a41
SHA199c986a0e3bc15532bbca5a18ff90de93fefe7fc
SHA25608f53032b63ada0a816ab77088624bef24a5451b7c7e0de05f958e5bd4e6977b
SHA51299f94d1016eb7bff8deed9eb68c6d26756b2b02a30c4aa5dcc111429e0117acfbc15d7f4119fe06abead5039ee241afc1e6756d2e2250a08fcc818a50598b6cf
-
C:\Users\Admin\AppData\Local\Temp\perperFilesize
68B
MD5a6585d9cf9d692905da3ed6c1b9dd4c1
SHA1166b3aece6d5a7d172acd0a1327af9265a5bf5d4
SHA25650a38aee5de374bab740c163c3debc500041a2ee3aad01d466347eecf2540015
SHA512a402fcebe80023edc9322adeecc89b8df845a80061008c26b890e33636869817460b57a326ee65dcd2bd7275933f9407be96aba7bfeae17530b55985ad00c65c
-
C:\Users\Admin\AppData\Local\Temp\perperperFilesize
67B
MD5e4bcd320585af9f77671cc6e91fe9de6
SHA115f12439eb3e133affb37b29e41e57d89fc90e06
SHA256a1e0f5a9cfc9615222f04e65455c7c4c1ba86710275afffd472428a293c31ec8
SHA51200497885531c0b84fe869828e5f2c0631f2f175f961c62175736487ae703252ba7393f882ffe99d8c4bcdb951172e35daa9ca41f45e64ce97fbae7721b25c112
-
C:\Users\Admin\AppData\Local\Temp\perperperperFilesize
67B
MD558b2f90cc0182925ae0bab51700b14ab
SHA1d2975adeb8dc68f2f5e10edee524de78e79828db
SHA2568114822fe9a58e5ba08abb480dd595109c66a49d9afc404f85843915694c2964
SHA512de6154d3d44c7e332f5cf1f3b1e4f20612ecd37f08fa60382ecc5008af2d9a55216357d6927e706fd2ef60b772e7941631fdfe9b1d615e5264e99cffe59ad782
-
C:\Users\Admin\AppData\Roaming\28803048\svchost.exeFilesize
76KB
MD5c80f556153f4798901692cce450bbb60
SHA1ceffdae200685c6cc6e9f0a71748346e157e86b0
SHA25677998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c
SHA5121e4e7a88e5fe217e3c5e80415d11203a192db43814feee4b2d53b107d9047dd37ec491195776ea400ecb92723c464c4d02cac2430c8ea552b5697cd08bc50c4c
-
\??\c:\users\admin\appdata\roaming\28803048\svchost.exeFilesize
76KB
MD5c80f556153f4798901692cce450bbb60
SHA1ceffdae200685c6cc6e9f0a71748346e157e86b0
SHA25677998d6e1369d8666340525d9fb941b93fe5cfb6c02a045d78f736ae57aac56c
SHA5121e4e7a88e5fe217e3c5e80415d11203a192db43814feee4b2d53b107d9047dd37ec491195776ea400ecb92723c464c4d02cac2430c8ea552b5697cd08bc50c4c
-
memory/32-148-0x0000000000000000-mapping.dmp
-
memory/548-140-0x0000000000000000-mapping.dmp
-
memory/804-138-0x0000000000000000-mapping.dmp
-
memory/1852-137-0x0000000000000000-mapping.dmp
-
memory/2128-144-0x0000000000000000-mapping.dmp
-
memory/2156-132-0x0000000000000000-mapping.dmp
-
memory/2528-139-0x0000000000000000-mapping.dmp
-
memory/2532-146-0x0000000000000000-mapping.dmp
-
memory/3460-133-0x0000000000000000-mapping.dmp
-
memory/3528-136-0x0000000000000000-mapping.dmp
-
memory/4136-142-0x0000000000000000-mapping.dmp
-
memory/4424-134-0x0000000000000000-mapping.dmp