Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-12-2022 12:33

General

  • Target

    cc2cd802bca6866b8c678f82d6bb38c3cf2eddf190232d4e0234f4b1d17d2b77.exe

  • Size

    36KB

  • MD5

    c249d8cc7298772ec12f4b3c3093c1c3

  • SHA1

    87e5324311b850412560900d9c97801b22f2c85b

  • SHA256

    cc2cd802bca6866b8c678f82d6bb38c3cf2eddf190232d4e0234f4b1d17d2b77

  • SHA512

    a7fccd2d9e2c893b03c81ec673707e14fb31f98a6f104a70d4d80f53743b3a8fd800b51ca3842ed1ea7df59f129653fbcd74c5a04f9c6a30494229a274ae6d06

  • SSDEEP

    768:eFFu30/ot3MA5ND9HJPEsA2uj+yL+Sfe8kcjxJaOOM9:+FVAHfPG2ulLDHLa

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc2cd802bca6866b8c678f82d6bb38c3cf2eddf190232d4e0234f4b1d17d2b77.exe
    "C:\Users\Admin\AppData\Local\Temp\cc2cd802bca6866b8c678f82d6bb38c3cf2eddf190232d4e0234f4b1d17d2b77.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:516
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\\svchost.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1040

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe

    Filesize

    36KB

    MD5

    c249d8cc7298772ec12f4b3c3093c1c3

    SHA1

    87e5324311b850412560900d9c97801b22f2c85b

    SHA256

    cc2cd802bca6866b8c678f82d6bb38c3cf2eddf190232d4e0234f4b1d17d2b77

    SHA512

    a7fccd2d9e2c893b03c81ec673707e14fb31f98a6f104a70d4d80f53743b3a8fd800b51ca3842ed1ea7df59f129653fbcd74c5a04f9c6a30494229a274ae6d06

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe

    Filesize

    36KB

    MD5

    c249d8cc7298772ec12f4b3c3093c1c3

    SHA1

    87e5324311b850412560900d9c97801b22f2c85b

    SHA256

    cc2cd802bca6866b8c678f82d6bb38c3cf2eddf190232d4e0234f4b1d17d2b77

    SHA512

    a7fccd2d9e2c893b03c81ec673707e14fb31f98a6f104a70d4d80f53743b3a8fd800b51ca3842ed1ea7df59f129653fbcd74c5a04f9c6a30494229a274ae6d06

  • C:\Users\Admin\AppData\Roaming\KB150101.exe

    Filesize

    36KB

    MD5

    c249d8cc7298772ec12f4b3c3093c1c3

    SHA1

    87e5324311b850412560900d9c97801b22f2c85b

    SHA256

    cc2cd802bca6866b8c678f82d6bb38c3cf2eddf190232d4e0234f4b1d17d2b77

    SHA512

    a7fccd2d9e2c893b03c81ec673707e14fb31f98a6f104a70d4d80f53743b3a8fd800b51ca3842ed1ea7df59f129653fbcd74c5a04f9c6a30494229a274ae6d06

  • memory/1040-132-0x0000000000000000-mapping.dmp