d80ce492587749aad969bc2112a80eb639f063353ae4cbfb36b8edffafb307aa

Analysis

max time kernel
158s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 15:16

Target

d80ce492587749aad969bc2112a80eb639f063353ae4cbfb36b8edffafb307aa.exe
Size

40KB
MD5

a6d1f46429028a69831b2a80c9cbfc9b
SHA1

c8c426aae47fcdd52a26ca09b7fb2aaed3cbc2a9
SHA256

d80ce492587749aad969bc2112a80eb639f063353ae4cbfb36b8edffafb307aa
SHA512

203617c1e02c8fd29636540d6d60df6024bf41a5e7fa954aa0f246113c38cbccacd95e35a5907710e182b3ab36f1eec627f3c182912def4e19ac3b39e6b06f47
SSDEEP

384:karh4Mb11zmaXmfWveQPaEK2nDvkHrx0Xqnqpyx0b1V9y8zqLBHQiEzc1W:Zdbrlk/DSnDsHkwKyxWLKNHEzS

Score

8^/10

upx

Executes dropped EXE 2 IoCs

pid	Process
632	ntmdm.exe
1164	ntmdm.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/files/0x000a000000022e0f-133.dat	upx
behavioral2/files/0x000a000000022e0f-134.dat	upx
behavioral2/files/0x000a000000022e0f-135.dat	upx
behavioral2/memory/632-136-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/1164-137-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/1164-138-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ntmdm.exe	d80ce492587749aad969bc2112a80eb639f063353ae4cbfb36b8edffafb307aa.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ntmdm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ntmdm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ntmdm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ntmdm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ntmdm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4860	d80ce492587749aad969bc2112a80eb639f063353ae4cbfb36b8edffafb307aa.exe
4860	d80ce492587749aad969bc2112a80eb639f063353ae4cbfb36b8edffafb307aa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 632	4860	d80ce492587749aad969bc2112a80eb639f063353ae4cbfb36b8edffafb307aa.exe	80
PID 4860 wrote to memory of 632	4860	d80ce492587749aad969bc2112a80eb639f063353ae4cbfb36b8edffafb307aa.exe	80
PID 4860 wrote to memory of 632	4860	d80ce492587749aad969bc2112a80eb639f063353ae4cbfb36b8edffafb307aa.exe	80

C:\Users\Admin\AppData\Local\Temp\d80ce492587749aad969bc2112a80eb639f063353ae4cbfb36b8edffafb307aa.exe
"C:\Users\Admin\AppData\Local\Temp\d80ce492587749aad969bc2112a80eb639f063353ae4cbfb36b8edffafb307aa.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\ntmdm.exe
  C:\Windows\system32\ntmdm.exe -inst
  2⤵
  - Executes dropped EXE
  PID:632

C:\Windows\SysWOW64\ntmdm.exe

Filesize
18KB

MD5
603f526d15ed0b4544b23f692e188311

SHA1
8f32ade1b825cb276c98bbc082ed70ae06583db5

SHA256
34e66c9db758ac9e2f1fb9dd5dad3ac30a77a291cd16ca2ed0dd1d7c432cb403

SHA512
67d226802510037eb261809f2d49827a6459ce695c9a0e39f59985a4cff372172766a265f6be39fd94224924898f9353a4a207132af96fdd83b92e32f8330d9a

Download Submit
C:\Windows\SysWOW64\ntmdm.exe

Filesize
18KB

MD5
603f526d15ed0b4544b23f692e188311

SHA1
8f32ade1b825cb276c98bbc082ed70ae06583db5

SHA256
34e66c9db758ac9e2f1fb9dd5dad3ac30a77a291cd16ca2ed0dd1d7c432cb403

SHA512
67d226802510037eb261809f2d49827a6459ce695c9a0e39f59985a4cff372172766a265f6be39fd94224924898f9353a4a207132af96fdd83b92e32f8330d9a

Download Submit
C:\Windows\SysWOW64\ntmdm.exe

Filesize
18KB

MD5
603f526d15ed0b4544b23f692e188311

SHA1
8f32ade1b825cb276c98bbc082ed70ae06583db5

SHA256
34e66c9db758ac9e2f1fb9dd5dad3ac30a77a291cd16ca2ed0dd1d7c432cb403

SHA512
67d226802510037eb261809f2d49827a6459ce695c9a0e39f59985a4cff372172766a265f6be39fd94224924898f9353a4a207132af96fdd83b92e32f8330d9a

Download Submit
memory/632-136-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1164-137-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1164-138-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download