c6e7eeae1ca7ee86f1e5c7725cee6c25816cf4f02a3b3f2fa8875f2e951c6959 | Triage

Analysis

max time kernel
51s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 22:05

Sharing

Report Analysis Logs

General

Target

fb8128ee56e36049e6db2723755f9d9b.exe
Size

36KB
MD5

fb8128ee56e36049e6db2723755f9d9b
SHA1

0c1e53cf873a781dec361cfe56302f4f3893346d
SHA256

c6e7eeae1ca7ee86f1e5c7725cee6c25816cf4f02a3b3f2fa8875f2e951c6959
SHA512

c98da2265a7e8788ec8a47a8bfa323dfceedaddd1e7e51d53e6f994a3e6084e7a93b4a12eb5e1781944e77aa6fa7fccd8d787f53f96216a384eba752f4e61709
SSDEEP

384:TShGKkOIf+FSde/7uZDia7nSowRNgGubTw7HDs4uujCkOIf+:21x177a8ghwvtH0

Score

1^/10

Malware Config

Signatures

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\WOW6432Node\CLSID	fb8128ee56e36049e6db2723755f9d9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}	fb8128ee56e36049e6db2723755f9d9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	fb8128ee56e36049e6db2723755f9d9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	fb8128ee56e36049e6db2723755f9d9b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4656	fb8128ee56e36049e6db2723755f9d9b.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2428	4656	fb8128ee56e36049e6db2723755f9d9b.exe	51
PID 4656 wrote to memory of 2428	4656	fb8128ee56e36049e6db2723755f9d9b.exe	51
PID 4656 wrote to memory of 2428	4656	fb8128ee56e36049e6db2723755f9d9b.exe	51
PID 4656 wrote to memory of 3460	4656	fb8128ee56e36049e6db2723755f9d9b.exe	49
PID 4656 wrote to memory of 3460	4656	fb8128ee56e36049e6db2723755f9d9b.exe	49
PID 4656 wrote to memory of 3460	4656	fb8128ee56e36049e6db2723755f9d9b.exe	49

C:\Users\Admin\AppData\Local\Temp\fb8128ee56e36049e6db2723755f9d9b.exe
"C:\Users\Admin\AppData\Local\Temp\fb8128ee56e36049e6db2723755f9d9b.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\inf\default.exe
  2⤵
  PID:3460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\inf\magrao.exe
  2⤵
  PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads