6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

240316-sq9desff3410

16/03/2024, 15:16

240316-sns9esdf2110

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Trojan/666mm psy/666mm psy.exe
Size 7KB
Sample240316-sq9desff34
SHA256 16f61017a179c22b18ef3b9207b1fa4dc8bc242fd36c9e73192b1a20a088e506
MD5 0094d516fb8b1cd38dbc22320db9d57c
SHA1 70dec0d081c29461c1a534905fa3ca13f559eaf9
SHA512 2fe0b815f5aee8f7b1f61d69ab8ec9e981b087a05914c64af230258f85854982026303014d997414941ec0c22c85e1ea057eb0b235883156729ce977efdbd3d0
SSDEEP 96:0P67TeuaABBDSyst9pvr51V+65lssssssso:0y7TqABBW517lssssssso
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

evasion

pid	Process
3604	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings\MuiCache	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3604	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2204	5000	666mm psy.exe	91
PID 5000 wrote to memory of 2204	5000	666mm psy.exe	91
PID 5000 wrote to memory of 2204	5000	666mm psy.exe	91
PID 2204 wrote to memory of 3604	2204	cmd.exe	92
PID 2204 wrote to memory of 3604	2204	cmd.exe	92
PID 2204 wrote to memory of 3604	2204	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666mm psy\666mm psy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\cmd.exe
  /c ""C:\Users\Admin\AppData\Local\Temp\240616234.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3604

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

240616234.bat

Path C:\Users\Admin\AppData\Local\Temp\240616234.bat
Size 911B
SHA256 6f88a1b6fb5975e2e49b33e7c9dabb593b18b2e7254bbe41263a9acc7294c2ac
MD5 2e90ad588f5329388216c652eebd4a33
SHA1 baa4f47ee4f195d854f8db905fcbb2539556f0e0
SHA512 b793ffcfca291e52855dd92ce1f948ce8b6f6bfe0e9a878cf7c37630b621eb417fe8b720bea8f088bec98b26c6e379bb1212d8518bb6ebed8b9840e2f9f9f778
MD5 SHA1 SHA512

Submit Download

memory/5000-2-0x0000000000400000-0x0000000000407000-memory.dmp

Download