Analysis
-
max time kernel
111s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2023 01:59
Behavioral task
behavioral1
Sample
b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe
Resource
win10v2004-20230220-en
General
-
Target
b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe
-
Size
3.2MB
-
MD5
e8b0bf65f4b7599b88d870885cf56a97
-
SHA1
90f64dbfbe1cacaccfddd4e5676d3543b78fac63
-
SHA256
b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e
-
SHA512
8b1bc1a817544bef98393ff6d5d6c0486710cea176e763f9d82803a409c0352cfe05f046b37579ca5c45879eef40683a07b65a8fddc76f54471f859b18f0c83c
-
SSDEEP
49152:7CYeGbfBf2TFASVWBTdE4CfO5qo0zdGtATpO/TcRfhqmTvbKixHKZ7eFxC5PQQXn:OvCcy2v4CJqyqmTu3I4IQ
Malware Config
Signatures
-
Modifies Control Panel 3 IoCs
Processes:
b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\sShortDate = "yyyy-MM-dd" b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\iDate = "2" b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\sDate = "-" b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exepid process 4500 b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe 4500 b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe 4500 b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exedescription pid process target process PID 4500 wrote to memory of 1316 4500 b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe splwow64.exe PID 4500 wrote to memory of 1316 4500 b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe"C:\Users\Admin\AppData\Local\Temp\b106fea00c11c0064890fb08bbdc5edb0d8f9104d2bf9e0376874b7c3138304e.exe"1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Config.iniFilesize
230B
MD56c6c0ab352620fc15e2ad3bbb3c9cfe9
SHA194d3f197c9df5d8cf2c3b09bedb122a94adac9d2
SHA256e577ac3cb2c2022c63fee355691d2910109bc510cf0eaa6b59eb8740bcb6dbb7
SHA512e67fde1b132c5d0330f023cb364e2e28c9dfa58e76eeea07d24166cc2b8290d32f7729a225dc864e14668544acba7fb97702ca4242904469569d0d1c3395f160
-
memory/4500-141-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/4500-136-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/4500-143-0x00000000057C0000-0x00000000057C1000-memory.dmpFilesize
4KB
-
memory/4500-144-0x0000000002AC0000-0x0000000002AC1000-memory.dmpFilesize
4KB
-
memory/4500-138-0x0000000002AC0000-0x0000000002AC1000-memory.dmpFilesize
4KB
-
memory/4500-139-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/4500-140-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/4500-133-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/4500-165-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/4500-135-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/4500-137-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/4500-145-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/4500-146-0x0000000005C10000-0x0000000005C11000-memory.dmpFilesize
4KB
-
memory/4500-147-0x0000000005DE0000-0x0000000005DE1000-memory.dmpFilesize
4KB
-
memory/4500-148-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/4500-149-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/4500-134-0x0000000000400000-0x0000000000D43000-memory.dmpFilesize
9.3MB
-
memory/4500-142-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB