Analysis
-
max time kernel
122s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-12-2023 14:36
Static task
static1
Behavioral task
behavioral1
Sample
016c518d029b18f76db7f08d50684044.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
016c518d029b18f76db7f08d50684044.exe
Resource
win10v2004-20231215-en
General
-
Target
016c518d029b18f76db7f08d50684044.exe
-
Size
196KB
-
MD5
016c518d029b18f76db7f08d50684044
-
SHA1
5b187f609200a7517cb8de2022a6564c7517425d
-
SHA256
623fce93343a18ee007b6c05f0e7d53de63575c2c1d72e8d4eee12e29adab6cb
-
SHA512
30db7a55473cb0ba45d092c006c7a5fb52e36ceaaecacf579af17254abc21a8351ff82be78b70a99e0b026aa79350c6e941447c87bbf295b31f69d6ce2551624
-
SSDEEP
3072:+yPMgg+O4H5MyRWC4fPu52uqZl4U7AoHo7lOdNZwMRoLta6+OAl6L60:Phgg66Wbu5rwunTCN2+l6
Malware Config
Signatures
-
Modifies registry key 1 TTPs 1 IoCs
pid Process 2584 reg.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2556 2252 016c518d029b18f76db7f08d50684044.exe 29 PID 2252 wrote to memory of 2556 2252 016c518d029b18f76db7f08d50684044.exe 29 PID 2252 wrote to memory of 2556 2252 016c518d029b18f76db7f08d50684044.exe 29 PID 2252 wrote to memory of 2556 2252 016c518d029b18f76db7f08d50684044.exe 29 PID 2556 wrote to memory of 2584 2556 cmd.exe 31 PID 2556 wrote to memory of 2584 2556 cmd.exe 31 PID 2556 wrote to memory of 2584 2556 cmd.exe 31 PID 2556 wrote to memory of 2584 2556 cmd.exe 31 PID 2556 wrote to memory of 2608 2556 cmd.exe 32 PID 2556 wrote to memory of 2608 2556 cmd.exe 32 PID 2556 wrote to memory of 2608 2556 cmd.exe 32 PID 2556 wrote to memory of 2608 2556 cmd.exe 32 PID 2556 wrote to memory of 2608 2556 cmd.exe 32 PID 2556 wrote to memory of 2608 2556 cmd.exe 32 PID 2556 wrote to memory of 2608 2556 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\016c518d029b18f76db7f08d50684044.exe"C:\Users\Admin\AppData\Local\Temp\016c518d029b18f76db7f08d50684044.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Start.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations /v ModRiskFileTypes /t REG_SZ /d .exe /f3⤵
- Modifies registry key
PID:2584
-
-
C:\Windows\SysWOW64\gpupdate.exegpupdate /force3⤵PID:2608
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200B
MD59cedeb0b293d2b5491225ef3d9eb2a8b
SHA1b607ef9bd319b6ec696c8dab8a314998d133298b
SHA2563fc59706783a0778da9121da52a63e34e47c82f436d5b14943e14fb418fd4f08
SHA512ec7d4544e32b1ea460895b1037a9eca2529eed45d6ee1644f83dfc4d4ad8f7c32a811ee4627bc6b243fb5d5c9e3e2b22060d6a2903692830ff1f114d2b9f3cfc