35e51d7c7a8ea66b62f9ec54ee6aae342d275df50636d80b6925ea578cab1468

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 08:07

Target

55ecaee29747f91f29820e9612d0aa1b.exe
Size

130KB
MD5

55ecaee29747f91f29820e9612d0aa1b
SHA1

6ae1499821588a276ccbdc586bb217b5aba5ac35
SHA256

35e51d7c7a8ea66b62f9ec54ee6aae342d275df50636d80b6925ea578cab1468
SHA512

788097fb6115d1947f6ed90b71f6dbefc15b55d57bab910675bf82b9af6530553ac5c988445faab166b383d6afc1e7872c1ba31ab4186a476f198f1456a7d108
SSDEEP

3072:T04/We+vRh6HWEz9UIXxWPKT9mlTQHgj/uFyJBTw06pJ:TH/Weoh6xUIXMPUUlTQOW4Dm

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2004	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\web.exe	55ecaee29747f91f29820e9612d0aa1b.exe
File opened for modification	C:\Windows\SysWOW64\web.exe	55ecaee29747f91f29820e9612d0aa1b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Debug\web32.dll	55ecaee29747f91f29820e9612d0aa1b.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F49C475D-5651-4A94-B289-9953F9248EF9}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F49C475D-5651-4A94-B289-9953F9248EF9}\ = "url"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F49C475D-5651-4A94-B289-9953F9248EF9}\InProcServer32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F49C475D-5651-4A94-B289-9953F9248EF9}\InProcServer32\ = "C:\\Windows\\Debug\\web32.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F49C475D-5651-4A94-B289-9953F9248EF9}\InProcServer32\ThreadingModel = "Apartment"	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
616	regedit.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1920	2932	55ecaee29747f91f29820e9612d0aa1b.exe	30
PID 2932 wrote to memory of 1920	2932	55ecaee29747f91f29820e9612d0aa1b.exe	30
PID 2932 wrote to memory of 1920	2932	55ecaee29747f91f29820e9612d0aa1b.exe	30
PID 2932 wrote to memory of 1920	2932	55ecaee29747f91f29820e9612d0aa1b.exe	30
PID 2932 wrote to memory of 2004	2932	55ecaee29747f91f29820e9612d0aa1b.exe	29
PID 2932 wrote to memory of 2004	2932	55ecaee29747f91f29820e9612d0aa1b.exe	29
PID 2932 wrote to memory of 2004	2932	55ecaee29747f91f29820e9612d0aa1b.exe	29
PID 2932 wrote to memory of 2004	2932	55ecaee29747f91f29820e9612d0aa1b.exe	29
PID 1920 wrote to memory of 616	1920	cmd.exe	32
PID 1920 wrote to memory of 616	1920	cmd.exe	32
PID 1920 wrote to memory of 616	1920	cmd.exe	32
PID 1920 wrote to memory of 616	1920	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\55ecaee29747f91f29820e9612d0aa1b.exe
"C:\Users\Admin\AppData\Local\Temp\55ecaee29747f91f29820e9612d0aa1b.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\55ecaee29747f91f29820e9612d0aa1b.exe"
  2⤵
  - Deletes itself
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\run1.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Users\Admin\AppData\Local\Temp\s1.reg
    3⤵
    - Modifies registry class
    - Runs .reg file with regedit
    PID:616

C:\Users\Admin\AppData\Local\Temp\run1.bat

Filesize
118B

MD5
c9ca0afd6c6d4ba684394ab5ee38482c

SHA1
218342e5aa6ad25831f0f4991dd45cc822940206

SHA256
fb1820a50d3feaa20d5c43c92ce107c025d80549a0337b272df8c9f5ce89c25c

SHA512
3c8228a0cada2ef3a4c8fba626afd0bb5f518413243f0473842ae16a96a72e8b96229026413721c9472908945a6198ee6aa260f6c7516b984b3f7de6889a0495

Download Submit
C:\Users\Admin\AppData\Local\Temp\s1.reg

Filesize
401B

MD5
5e32fb9a736a8c57fc91d686f47933a0

SHA1
af36957427a7941e76706171e5943fdf5e8345e6

SHA256
1691cac4fc9de53de098f525ff02f9a01cabbc952f00eed8c533f62190ef8ba4

SHA512
96e4734944bbee46e7b3b3ca5bb692482df6ce91fbf764828d1304d1133ee7e3dc6c63cb3d5bd4e7a59adbc9a23af438490db5827cfb0438a3aa8eaf91a2546e

Download Submit
memory/2932-12-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2932-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2932-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2932-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download