6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

16/03/2024, 15:16

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 15:16

Target
Trojan/4mm psy/4mm psy.exe
Size 6KB
Sample240316-sns9esdf21
SHA256 aa761ff437cee15e503fd70fda87dbdd04329ac4614477cf4670babd6c2bee02
MD5 529ef7f53e3fd61c1cad2c7ecf8b1c6d
SHA1 d67ef17f5389fa2e38f2acdf9f703be88b1773f7
SHA512 d996473bee9724bce5293c6bf711efa6a01f23aebdf60926a01bca44fa257eeb49935b4113ee9b65fbbc0d2754689009b9b03ebb4962426c53dabe9f3c2787b9
SSDEEP 48:0Pzuz3/foXeYDjyaAYqMettsQSaJiTi8xLEcztPLb3b3vr5vEuu6P+65I6FPrSh:0P67TeuaABBDSyst9pvr51V+65vDs
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4996	OpenWith.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4236	1616	4mm psy.exe	89
PID 1616 wrote to memory of 4236	1616	4mm psy.exe	89
PID 1616 wrote to memory of 4236	1616	4mm psy.exe	89
PID 4236 wrote to memory of 3076	4236	cmd.exe	90
PID 4236 wrote to memory of 3076	4236	cmd.exe	90
PID 4236 wrote to memory of 3076	4236	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\4mm psy\4mm psy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\cmd.exe
  /c ""C:\Users\Admin\AppData\Local\Temp\240601453.bat" "
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\cscript.exe
    cscript [regtaskmgr.vbs]
    3⤵
    PID:3076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4996

240601453.bat

Path C:\Users\Admin\AppData\Local\Temp\240601453.bat
Size 135B
SHA256 e22b0b5185247a3ca52cb7cd6a271efced0d1d6e8910294f7131241f5d58b7ee
MD5 826431d3df1879172a96555d7ba0aeef
SHA1 f56ff5d3c06f78f53884071d1357ba79ee85b96e
SHA512 e995b82e1716ab7f7ea8d810a441ce2b68e570c0e31386670e6c193a11131e5274747205a3245424b7d71b7b0745313bd522eff452b175c80425fbf5ef2bbc52
MD5 SHA1 SHA512

Submit Download

memory/1616-2-0x0000000000400000-0x0000000000407000-memory.dmp

Download