Analysis

  • max time kernel
    163s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2022 07:49

General

  • Target

    60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe

  • Size

    80KB

  • MD5

    5036136e716dca1240229eb7cd7a34a4

  • SHA1

    a13301388da33b4b4bcb10e490482b1db020e8a5

  • SHA256

    60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85

  • SHA512

    1833e18587f3f0435930e7c4de440c5bf52ebe0abcb9f80f417914eea4a63f2ffbe0ecd03ba476c51231a816a334f52b40a77b348099a45b596f4785f5181418

  • SSDEEP

    1536:uy0JHefrMd0r592sT4kDVH/8b26XXu5C84W9jcgduZD5dKo:uy0ndM5nM8NiDX+3/9jcKuZDH

Score
8/10

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe
    "C:\Users\Admin\AppData\Local\Temp\60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Modifies Internet Explorer settings
    • Suspicious use of WriteProcessMemory
    PID:4232
    • C:\Users\Admin\AppData\Local\Temp\60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe
      "C:\Users\Admin\AppData\Local\Temp\60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe" del
      2⤵
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Windows\SysWOW64\cmd.exe
        /c del C:\Users\Admin\AppData\Local\Temp\60300B~1.EXE.tmp >> NUL
        3⤵
          PID:1232

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    2
    T1112

    Impact

    Defacement

    1
    T1491

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1232-133-0x0000000000000000-mapping.dmp
    • memory/1668-132-0x0000000000000000-mapping.dmp