Analysis
-
max time kernel
141s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2023 04:44
Behavioral task
behavioral1
Sample
d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.exe
Resource
win7-20230220-en
General
-
Target
d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.exe
-
Size
1.5MB
-
MD5
6a549ea4ea79895f498f7099352642a6
-
SHA1
7893067f508e796720ee39afac26d65e1f1a6974
-
SHA256
d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf
-
SHA512
fcb4c911c1b0ff2f3f57edfda94816fc61bea87a07c50222841cf86b57ca1e3959f4c08b55279688041fc692e38d66df35c42c84bb0d576323224dafed83b41e
-
SSDEEP
12288:/xEHRw7YRrh74uSVfdUQQ5Rplis9rCL8wTp2SqdnWWpEOG8ck566t51wd1:aHRwiruuGdzsOs9GLBSWWrU1
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmppid process 632 d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp -
Processes:
resource yara_rule behavioral2/memory/2796-133-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral2/memory/2796-141-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 25 IoCs
Processes:
d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmpdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gsp\ShellNew\NullFile d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D188B5~1.TMP,1" d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\print\ddeexec\ = "[print(\"%1\")]" d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D188B5~1.TMP /dde" d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\printto\ddeexec d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D188B5~1.TMP /dde" d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.gsp\ShellNew d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\ = "SketchpadDocument" d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\print\ddeexec d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\print d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\open\command d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D188B5~1.TMP /dde" d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gsp d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gsp\ShellNew d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\DefaultIcon d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\open d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\printto d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\print\command d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\printto\command d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gsp\ = "Sketchpad.Document" d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\open\ddeexec d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sketchpad.Document\shell\open\ddeexec\ = "[open(\"%1\")]" d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmppid process 632 d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp 632 d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.exedescription pid process target process PID 2796 wrote to memory of 632 2796 d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.exe d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp PID 2796 wrote to memory of 632 2796 d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.exe d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp PID 2796 wrote to memory of 632 2796 d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.exe d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.exe"C:\Users\Admin\AppData\Local\Temp\d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmpd188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf -ma -md2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:632
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
815KB
MD5c211c5ea1d176229c69d36d44c38cc81
SHA1aace6525bc7337d7d3f8a4a77ec5dab958230a49
SHA2561165280fab19a42094a4491cf97cc5dcdc92a710ca30cae21d117882dfa597ce
SHA51253aca915f61d0affd55a04170649bfeb1ede78a4e2660df1062eee9c50422fa2698ddfa1e902c9436d853137cdc96dfc3b75de9ce93936dac1d149c6676dba7a
-
C:\Users\Admin\AppData\Local\Temp\d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp
Filesize726KB
MD516acf5c1a006a81bb9bf62007cd75646
SHA192d8c2992e982a5c1f5cef8526faae3fd93421a1
SHA2565025cffb154f55027062c18fe4f425e1ba1af8807e907787a56585571c0ddb8a
SHA5128fbea59317a00123216dc8a78846d12ae0711c4c2311aeca736cf6f2f398e2bd7a1f8b9ae16c566a7d0d41da1968d4debc3b116912dfb5e890faee657cd5f62c
-
C:\Users\Admin\AppData\Local\Temp\d188b53a0e0b74cb330ad2934e5d0f7b460769a2d4452a4cc42731e3b57badaf.tmp
Filesize726KB
MD516acf5c1a006a81bb9bf62007cd75646
SHA192d8c2992e982a5c1f5cef8526faae3fd93421a1
SHA2565025cffb154f55027062c18fe4f425e1ba1af8807e907787a56585571c0ddb8a
SHA5128fbea59317a00123216dc8a78846d12ae0711c4c2311aeca736cf6f2f398e2bd7a1f8b9ae16c566a7d0d41da1968d4debc3b116912dfb5e890faee657cd5f62c