Analysis
-
max time kernel
260s -
max time network
370s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
c9388874872aca135d86a2c4879a70e2c4fda6e0ed9bd81b97a5c511b3a26b4d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c9388874872aca135d86a2c4879a70e2c4fda6e0ed9bd81b97a5c511b3a26b4d.exe
Resource
win10v2004-20221111-en
General
-
Target
c9388874872aca135d86a2c4879a70e2c4fda6e0ed9bd81b97a5c511b3a26b4d.exe
-
Size
475KB
-
MD5
b0b6c3572a63556ac3bdc43dee1cbe71
-
SHA1
4f38ea276f3fdca70d49022b73450c89f38fa35c
-
SHA256
c9388874872aca135d86a2c4879a70e2c4fda6e0ed9bd81b97a5c511b3a26b4d
-
SHA512
c09c604f459c9148e820f963f5d366871637667592d893f1e3f4280150673b50ae2e30ac278e2d1088391e89ca82f59d8e4b6f567669dc00c2f94dc373d2af65
-
SSDEEP
6144:CLp42ewMEOdIGF0qzd4ej90tkCLd/VAeA7DI3yTf1xGWTJg:idFMZXZ+eqd/Clhm
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log c9388874872aca135d86a2c4879a70e2c4fda6e0ed9bd81b97a5c511b3a26b4d.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log wiawow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9388874872aca135d86a2c4879a70e2c4fda6e0ed9bd81b97a5c511b3a26b4d.exe"C:\Users\Admin\AppData\Local\Temp\c9388874872aca135d86a2c4879a70e2c4fda6e0ed9bd81b97a5c511b3a26b4d.exe"1⤵
- Drops file in Windows directory
PID:4380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3832
-
C:\Windows\System32\wiawow64.exeC:\Windows\System32\wiawow64.exe -Embedding1⤵
- Drops file in Windows directory
PID:4072
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308B
MD5fe28eff0ef7934a6a752a291c2700638
SHA13cc45ea56b750ecd5cb4506383d90442f5e336c1
SHA256e099ca60055182b3843a2aefa60475a9c99b24fd09cef30928cbc83c07299d37
SHA5120379d387c5143efe4d1e827c1b3dba50897e9e06b3b1612ce3b1830568d5b25493cab2ceb1d0323e37dc33c68a606d7a18af667a3fe834a734a12f0bb903cb6e