2144ddf9ed44c44837d1d0204db9b06f7f87e86453f74c1ef3c60311308a0244

Resubmissions

31/03/2023, 18:49

230331-xgtzladh5x 1

31/03/2023, 18:45

230331-xefzysce65 1

Analysis

max time kernel
103s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HoneCtrl.bat
Size

185KB
MD5

799ffbd9020f9c417e1370bc6cfcc073
SHA1

804b80539a3487af3e893072aacb1b1663dea538
SHA256

2144ddf9ed44c44837d1d0204db9b06f7f87e86453f74c1ef3c60311308a0244
SHA512

1a5f44eb22cb4a216d42e73a3284363df43f9e61052be8f4320277628073b72e57786ccbe54e38d72101d8785bc7130515a7648b460cccea550461b435d434bb
SSDEEP

3072:9Db0H5eExbE++fQXR97dyrSxBZiNP8R7GD19vbr/Ms9M9gO9OXPZW5EWWhdDxfi6:9DwH5eExbE+jZiNP8R7GD19vPtNzRICn

Score

1^/10

Malware Config

Signatures

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5108	reg.exe
4380	reg.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 5032	748	cmd.exe	84
PID 748 wrote to memory of 5032	748	cmd.exe	84
PID 748 wrote to memory of 5108	748	cmd.exe	85
PID 748 wrote to memory of 5108	748	cmd.exe	85
PID 748 wrote to memory of 3612	748	cmd.exe	86
PID 748 wrote to memory of 3612	748	cmd.exe	86
PID 748 wrote to memory of 3456	748	cmd.exe	87
PID 748 wrote to memory of 3456	748	cmd.exe	87
PID 748 wrote to memory of 4380	748	cmd.exe	88
PID 748 wrote to memory of 4380	748	cmd.exe	88
PID 748 wrote to memory of 4592	748	cmd.exe	89
PID 748 wrote to memory of 4592	748	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HoneCtrl.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\system32\mode.com
  Mode 130,45
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  reg add HKLM /F
  2⤵
  - Modifies registry key
  PID:5108
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Control\CrashControl" /v "DisplayParameters" /t REG_DWORD /d "1" /f
  2⤵
  PID:3612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
  2⤵
  PID:3456
- C:\Windows\system32\reg.exe
  reg add HKCU\CONSOLE /v VirtualTerminalLevel /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4380
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Hone" /v "Disclaimer"
  2⤵
  PID:4592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...