Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 05:46

General

  • Target

    f6c3b01b7361ca739392bc91a394e801d681bd3250aa6c926d769766e1962220.exe

  • Size

    2.5MB

  • MD5

    6d986c900a6826639d783dbce196b024

  • SHA1

    d9e1a8c956439a0461aa086cfa479aceedf4908f

  • SHA256

    f6c3b01b7361ca739392bc91a394e801d681bd3250aa6c926d769766e1962220

  • SHA512

    0fd6fabc5d14422e780bf32e04f2a9dbf164ce0197cf8439959675d6cf7bb1e1c02e68ccfe7a416ef60c047792df346f6efbb81b39e6556dffe1114b9cb51abc

  • SSDEEP

    6144:IFCDaoJbXLe43nVcb6FwNkTS9jXpJ3XGKHESjZIwpee9Er6:W2pLe43ab6S+TwXpJXGKkbARyr6

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6c3b01b7361ca739392bc91a394e801d681bd3250aa6c926d769766e1962220.exe
    "C:\Users\Admin\AppData\Local\Temp\f6c3b01b7361ca739392bc91a394e801d681bd3250aa6c926d769766e1962220.exe"
    1⤵
    • Drops file in Windows directory
    PID:4376
  • C:\Windows\System32\WaaSMedicAgent.exe
    C:\Windows\System32\WaaSMedicAgent.exe 3786ddd5534a5ca50b7090cdbc8efd42 K77wry81LUmFasKda3mefQ.0.1.0.0.0
    1⤵
    • Sets service image path in registry
    • Modifies data under HKEY_USERS
    PID:1892

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4376-132-0x0000000002080000-0x00000000020AF000-memory.dmp

          Filesize

          188KB