Analysis

  • max time kernel
    152s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2023 00:10

General

  • Target

    0813143616336dd94a6adfdc63287364.exe

  • Size

    211KB

  • MD5

    0813143616336dd94a6adfdc63287364

  • SHA1

    40fe1cde54bfe4ea7ca160162c46b69b20ae1589

  • SHA256

    e07a62364ed40dcb5d12ad4597ddfcf469575d69028f68e1df54cbd4ead598f5

  • SHA512

    cd715444b8e98a943b0014f7e6a5d2649ce0ffb28971f14f8f0d46053c623fc33c5fceac376a20461aac1981c1945397f3d548f0695398943401f9e603852c3c

  • SSDEEP

    6144:WDYsVX0DxzhCFyOZ6QTO8rtujvhjR/F9NnC:WDYaUEyOEmOqEjJd/FfnC

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0813143616336dd94a6adfdc63287364.exe
    "C:\Users\Admin\AppData\Local\Temp\0813143616336dd94a6adfdc63287364.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Windows\SysWOW64\REGEDIT.exe
      REGEDIT /S C:\WINDOWS\SCANREG01.REG
      2⤵
      • Runs .reg file with regedit
      PID:4492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1268-0-0x0000000000400000-0x00000000004C8EF4-memory.dmp

    Filesize

    803KB

  • memory/1268-1-0x0000000002160000-0x0000000002161000-memory.dmp

    Filesize

    4KB

  • memory/1268-5-0x0000000000400000-0x00000000004C8EF4-memory.dmp

    Filesize

    803KB

  • memory/1268-6-0x0000000002160000-0x0000000002161000-memory.dmp

    Filesize

    4KB

  • memory/1268-15-0x0000000000400000-0x00000000004C8EF4-memory.dmp

    Filesize

    803KB