253c4b8596352a6e5e392b199baec47ed3cef2637b3a9a720386c34ccdb48f82

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:33

Target

070b0a651c8e334ae54521c306bdb282.exe
Size

209KB
MD5

070b0a651c8e334ae54521c306bdb282
SHA1

94d681801ad7cb5fcd9fae40821d2aa39c385de8
SHA256

253c4b8596352a6e5e392b199baec47ed3cef2637b3a9a720386c34ccdb48f82
SHA512

5508cea1ac3fbb7fe7fd7fb3542b4b24c37d603088f1d28e2b2a3170e15e0d9c4e4a49ab2ede45949e5baad5a9801a095d07511c32f5531f253d9491ea6305a7
SSDEEP

6144:lldG8Jn86fjVdcWnTTt4//mIu5Tiq8zVBlVcX:NGE86fkWTTt43Dzfl

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
4988	u.dll
2444	mpress.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	calc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3552	OpenWith.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 2724	3080	070b0a651c8e334ae54521c306bdb282.exe	17
PID 3080 wrote to memory of 2724	3080	070b0a651c8e334ae54521c306bdb282.exe	17
PID 3080 wrote to memory of 2724	3080	070b0a651c8e334ae54521c306bdb282.exe	17
PID 2724 wrote to memory of 4988	2724	cmd.exe	18
PID 2724 wrote to memory of 4988	2724	cmd.exe	18
PID 2724 wrote to memory of 4988	2724	cmd.exe	18
PID 4988 wrote to memory of 2444	4988	u.dll	22
PID 4988 wrote to memory of 2444	4988	u.dll	22
PID 4988 wrote to memory of 2444	4988	u.dll	22
PID 2724 wrote to memory of 1144	2724	cmd.exe	21
PID 2724 wrote to memory of 1144	2724	cmd.exe	21
PID 2724 wrote to memory of 1144	2724	cmd.exe	21

C:\Users\Admin\AppData\Local\Temp\070b0a651c8e334ae54521c306bdb282.exe
"C:\Users\Admin\AppData\Local\Temp\070b0a651c8e334ae54521c306bdb282.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\43B0.tmp\vir.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Users\Admin\AppData\Local\Temp\u.dll
    u.dll -bat vir.bat -save 070b0a651c8e334ae54521c306bdb282.exe.com -include s.dll -overwrite -nodelete
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\441D.tmp\mpress.exe
      "C:\Users\Admin\AppData\Local\Temp\441D.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe441E.tmp"
      4⤵
      Executes dropped EXE
      PID:2444
- - C:\Windows\SysWOW64\calc.exe
    CALC.EXE
    3⤵
    - Modifies registry class
    PID:1144

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3552

memory/2444-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2444-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3080-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/3080-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/3080-71-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download