c6e7eeae1ca7ee86f1e5c7725cee6c25816cf4f02a3b3f2fa8875f2e951c6959 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:05

Sharing

Report Analysis Logs

General

Target

fb8128ee56e36049e6db2723755f9d9b.exe
Size

36KB
MD5

fb8128ee56e36049e6db2723755f9d9b
SHA1

0c1e53cf873a781dec361cfe56302f4f3893346d
SHA256

c6e7eeae1ca7ee86f1e5c7725cee6c25816cf4f02a3b3f2fa8875f2e951c6959
SHA512

c98da2265a7e8788ec8a47a8bfa323dfceedaddd1e7e51d53e6f994a3e6084e7a93b4a12eb5e1781944e77aa6fa7fccd8d787f53f96216a384eba752f4e61709
SSDEEP

384:TShGKkOIf+FSde/7uZDia7nSowRNgGubTw7HDs4uujCkOIf+:21x177a8ghwvtH0

Score

1^/10

Malware Config

Signatures

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}	fb8128ee56e36049e6db2723755f9d9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	fb8128ee56e36049e6db2723755f9d9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	fb8128ee56e36049e6db2723755f9d9b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2448	fb8128ee56e36049e6db2723755f9d9b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2928	2448	fb8128ee56e36049e6db2723755f9d9b.exe	28
PID 2448 wrote to memory of 2928	2448	fb8128ee56e36049e6db2723755f9d9b.exe	28
PID 2448 wrote to memory of 2928	2448	fb8128ee56e36049e6db2723755f9d9b.exe	28
PID 2448 wrote to memory of 2928	2448	fb8128ee56e36049e6db2723755f9d9b.exe	28
PID 2448 wrote to memory of 2532	2448	fb8128ee56e36049e6db2723755f9d9b.exe	30
PID 2448 wrote to memory of 2532	2448	fb8128ee56e36049e6db2723755f9d9b.exe	30
PID 2448 wrote to memory of 2532	2448	fb8128ee56e36049e6db2723755f9d9b.exe	30
PID 2448 wrote to memory of 2532	2448	fb8128ee56e36049e6db2723755f9d9b.exe	30

C:\Users\Admin\AppData\Local\Temp\fb8128ee56e36049e6db2723755f9d9b.exe
"C:\Users\Admin\AppData\Local\Temp\fb8128ee56e36049e6db2723755f9d9b.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\inf\magrao.exe
  2⤵
  PID:2928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\inf\default.exe
  2⤵
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads