bf1de2f61fb37c4e35c6f270ec1b1e3e637a9ae1a637f05f8889337659dc26b8

Resubmissions

20/05/2023, 03:00

230520-dhgk4sab52 7

20/05/2023, 02:56

230520-dfad1scg9v 7

Analysis

max time kernel
59s
max time network
65s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/05/2023, 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

memez-master/memez/memez.cpp
Size

8KB
MD5

44c6da2824fcea8f211ea33f5c9d2927
SHA1

829dc73e7cfece7be5120e06c4954f95d72be74b
SHA256

ca17b070f5db499a59aa7e6e22a5661b8d2f9a2d063cb2818790ce5ee3d96466
SHA512

8f310fed36e87ed745f6f6edd5bcf406d77d5e7c37cf2c1dcb2b34cbc17f8be43e7927cefbb6d9567854593a70492b120dce8369fab470fd7d2a18b7d0cafda9
SSDEEP

192:OYUzG9L3MfVBLB2AAk1XnS3QKknhwzOazuHchHHcBJaKi:WWL3GBLB2AFXnS3QKknOzOaxhH8BJaKi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\cpp_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.cpp	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\cpp_auto_file\shell\edit	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\cpp_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\cpp_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\cpp_auto_file\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\cpp_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\.cpp\ = "cpp_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\cpp_auto_file\shell\edit\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\cpp_auto_file\shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\cpp_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	860	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	860	AUDIODG.EXE
Token: 33	860	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	860	AUDIODG.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 580	1736	cmd.exe	29
PID 1736 wrote to memory of 580	1736	cmd.exe	29
PID 1736 wrote to memory of 580	1736	cmd.exe	29
PID 580 wrote to memory of 1440	580	rundll32.exe	30
PID 580 wrote to memory of 1440	580	rundll32.exe	30
PID 580 wrote to memory of 1440	580	rundll32.exe	30
PID 1520 wrote to memory of 632	1520	wmplayer.exe	35
PID 1520 wrote to memory of 632	1520	wmplayer.exe	35
PID 1520 wrote to memory of 632	1520	wmplayer.exe	35
PID 1520 wrote to memory of 632	1520	wmplayer.exe	35
PID 1520 wrote to memory of 632	1520	wmplayer.exe	35
PID 1520 wrote to memory of 632	1520	wmplayer.exe	35
PID 1520 wrote to memory of 632	1520	wmplayer.exe	35

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\memez-master\memez\memez.cpp
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\memez-master\memez\memez.cpp
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\memez-master\memez\memez.cpp
    3⤵
    PID:1440

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1772

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files (x86)\Windows Media Player\setup_wm.exe
  "C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
  2⤵
  PID:632

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x544
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads