4caf01ecb8dd5e3c68a9ce93196a4ed74b6e7c843ff56707ef8f7c84afcb5d05

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

381ff45f6cda9454dbfb1af003f0be86.exe
Size

249KB
MD5

381ff45f6cda9454dbfb1af003f0be86
SHA1

0fde1b733fb98ea1c2450f745cc6e6f3f460c3ca
SHA256

4caf01ecb8dd5e3c68a9ce93196a4ed74b6e7c843ff56707ef8f7c84afcb5d05
SHA512

05716acc769f00b3dda4a736d65e07d5e22fb72fff06183a323325d9571345931a967fbd0a4d52644f9fb37b27f43cd7ad5b0c141e20b8fdab37388cb1f4e971
SSDEEP

6144:QZQI7dkQqHNbbc/8Zz9DRAQW+Y7zk4NU9L/b:QZQIaptM/8J9qbI9L/b

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2760	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1052	Windows Aues

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Windows Aues	381ff45f6cda9454dbfb1af003f0be86.exe
File opened for modification	C:\Windows\Windows Aues	381ff45f6cda9454dbfb1af003f0be86.exe
File created	C:\Windows\Delete.bat	381ff45f6cda9454dbfb1af003f0be86.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	Windows Aues
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	Windows Aues
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	Windows Aues
Key created	\REGISTRY\USER\.DEFAULT\System	Windows Aues
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	Windows Aues
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	Windows Aues
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	Windows Aues
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	Windows Aues
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	Windows Aues

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1052	Windows Aues

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2760	1912	381ff45f6cda9454dbfb1af003f0be86.exe	31
PID 1912 wrote to memory of 2760	1912	381ff45f6cda9454dbfb1af003f0be86.exe	31
PID 1912 wrote to memory of 2760	1912	381ff45f6cda9454dbfb1af003f0be86.exe	31
PID 1912 wrote to memory of 2760	1912	381ff45f6cda9454dbfb1af003f0be86.exe	31
PID 1052 wrote to memory of 2764	1052	Windows Aues	29
PID 1052 wrote to memory of 2764	1052	Windows Aues	29
PID 1052 wrote to memory of 2764	1052	Windows Aues	29
PID 1052 wrote to memory of 2764	1052	Windows Aues	29

C:\Users\Admin\AppData\Local\Temp\381ff45f6cda9454dbfb1af003f0be86.exe
"C:\Users\Admin\AppData\Local\Temp\381ff45f6cda9454dbfb1af003f0be86.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.bat
  2⤵
  - Deletes itself
  PID:2760

C:\Windows\Windows Aues
"C:\Windows\Windows Aues"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
186B

MD5
c97bcdc3c44af526b96989e0492fe496

SHA1
cf328eb3eff0205b2760329b36b03e656588d1f9

SHA256
b78ca9fb44a29d369f0cad3c6b286833a7b27862c30f3bb8f988a5cc1a158bd1

SHA512
92b1f3fde69e98bc74adcce46fbcd4c143b23a3635bc38a6cc2c7448c032f6c6b7936562b5d3da53d27d9fcb9d51391fd8a5afd909c01ff3082c9732b72568bd

Download Submit
C:\Windows\Windows Aues

Filesize
249KB

MD5
381ff45f6cda9454dbfb1af003f0be86

SHA1
0fde1b733fb98ea1c2450f745cc6e6f3f460c3ca

SHA256
4caf01ecb8dd5e3c68a9ce93196a4ed74b6e7c843ff56707ef8f7c84afcb5d05

SHA512
05716acc769f00b3dda4a736d65e07d5e22fb72fff06183a323325d9571345931a967fbd0a4d52644f9fb37b27f43cd7ad5b0c141e20b8fdab37388cb1f4e971

Download Submit
memory/1052-6-0x00000000003C0000-0x00000000003C2000-memory.dmp

Filesize
8KB

Download
memory/1052-8-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1052-18-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1052-19-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1052-21-0x00000000003C0000-0x00000000003C2000-memory.dmp

Filesize
8KB

Download
memory/1052-22-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1912-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1912-1-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/1912-2-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1912-16-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download