6ec79179c1e61df21e38b754017b672d559f0537ce0a3b64afe7df97025fd01d

Analysis

max time kernel
1618s
max time network
1721s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MegaMaker.exe
Size

5.2MB
MD5

0b2ee8c1d994f1ac88900ab51c67feb2
SHA1

0b74aef9a77b0634b41c3076affe0c74004a6f62
SHA256

713b9843c19bdf147a595dbdb1882f90eb09e43017777fbbdf69b6815ea70fb1
SHA512

13afd824d6196145318df529cdeae2aa2a7eb7af845f4ea59f78b550df310ae7d1564aea4f939951b5fda3b216402b31dfc16be9dd719d0ae80e02e96d8c264a
SSDEEP

49152:Q1zyj2KOmC6IKJkFWBJIknan72ldLIuG+OMO7/3/F7VuyTmxHuzK5u8o3Wh7C8j9:QYjJLfZO/bJQ/YWhuKMSjmVje

Score

1^/10

Malware Config

Signatures

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\discord-472856437496741889	MegaMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\discord-472856437496741889\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MegaMaker.exe"	MegaMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\megamaker\shell	MegaMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\discord-472856437496741889\shell	MegaMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\discord-472856437496741889\DefaultIcon	MegaMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\megamaker\shell\open\command	MegaMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\megamaker\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MegaMaker.exe\" \"%1\""	MegaMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\discord-472856437496741889\ = "URL:Run game 472856437496741889 protocol"	MegaMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\discord-472856437496741889\URL Protocol	MegaMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\discord-472856437496741889\shell\open	MegaMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\megamaker\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MegaMaker.exe,1"	MegaMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\megamaker\ = "URL:MegaMaker Protocol"	MegaMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\megamaker\URL Protocol	MegaMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\megamaker\DefaultIcon	MegaMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\megamaker\shell\open	MegaMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\discord-472856437496741889\shell\open\command	MegaMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\discord-472856437496741889\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MegaMaker.exe"	MegaMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000_CLASSES\megamaker	MegaMaker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2264	MegaMaker.exe
2264	MegaMaker.exe

C:\Users\Admin\AppData\Local\Temp\MegaMaker.exe
"C:\Users\Admin\AppData\Local\Temp\MegaMaker.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-15-0x0000000012720000-0x0000000012760000-memory.dmp

Filesize
256KB

Download
memory/2264-16-0x00000000127B0000-0x00000000127BC000-memory.dmp

Filesize
48KB

Download
memory/2264-18-0x0000000072E30000-0x000000007351E000-memory.dmp

Filesize
6.9MB

Download
memory/2264-17-0x00000000738F0000-0x00000000738FC000-memory.dmp

Filesize
48KB

Download
memory/2264-21-0x0000000012720000-0x0000000012760000-memory.dmp

Filesize
256KB

Download
memory/2264-22-0x0000000072E30000-0x000000007351E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads