dddd52286ba167e416065b1815c2630218213aa8dd95513e43ead3f8650a5dd4

Analysis

max time kernel
18s
max time network
22s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MoveMW3Chair.exe
Size 968KB
Sample240612-2vda8atfne
SHA256 dddd52286ba167e416065b1815c2630218213aa8dd95513e43ead3f8650a5dd4
MD5 0862ecc07ea6cd2325d941e50eeb4365
SHA1 fbec081fc7c779ab8b8087fcffbe1de170b6c460
SHA512 d347b64ef2d45d931f2d92b32d88ed0df531f57663fd91a51401becf1bbb4fd1d0c5b6b61ed74abe39938e3d49690674df62584bd3aacbc4ebc93b90063734c9
SSDEEP 24576:yrw3IPQfmHFpOHsnRKRP+bM+O93l0fZS:ZmlsQURd+O93+x
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4772	1572	MoveMW3Chair.exe	82
PID 1572 wrote to memory of 4772	1572	MoveMW3Chair.exe	82
PID 4772 wrote to memory of 3620	4772	cmd.exe	83
PID 4772 wrote to memory of 3620	4772	cmd.exe	83
PID 4772 wrote to memory of 944	4772	cmd.exe	84
PID 4772 wrote to memory of 944	4772	cmd.exe	84
PID 4772 wrote to memory of 1568	4772	cmd.exe	85
PID 4772 wrote to memory of 1568	4772	cmd.exe	85
PID 1572 wrote to memory of 2616	1572	MoveMW3Chair.exe	90
PID 1572 wrote to memory of 2616	1572	MoveMW3Chair.exe	90
PID 1572 wrote to memory of 3096	1572	MoveMW3Chair.exe	91
PID 1572 wrote to memory of 3096	1572	MoveMW3Chair.exe	91
PID 1572 wrote to memory of 3668	1572	MoveMW3Chair.exe	92
PID 1572 wrote to memory of 3668	1572	MoveMW3Chair.exe	92
PID 1572 wrote to memory of 784	1572	MoveMW3Chair.exe	93
PID 1572 wrote to memory of 784	1572	MoveMW3Chair.exe	93
PID 1572 wrote to memory of 1424	1572	MoveMW3Chair.exe	96
PID 1572 wrote to memory of 1424	1572	MoveMW3Chair.exe	96
PID 1572 wrote to memory of 3956	1572	MoveMW3Chair.exe	97
PID 1572 wrote to memory of 3956	1572	MoveMW3Chair.exe	97
PID 1572 wrote to memory of 688	1572	MoveMW3Chair.exe	99
PID 1572 wrote to memory of 688	1572	MoveMW3Chair.exe	99
PID 1572 wrote to memory of 2460	1572	MoveMW3Chair.exe	100
PID 1572 wrote to memory of 2460	1572	MoveMW3Chair.exe	100
PID 1572 wrote to memory of 2016	1572	MoveMW3Chair.exe	101
PID 1572 wrote to memory of 2016	1572	MoveMW3Chair.exe	101
PID 1572 wrote to memory of 740	1572	MoveMW3Chair.exe	102
PID 1572 wrote to memory of 740	1572	MoveMW3Chair.exe	102
PID 1572 wrote to memory of 4224	1572	MoveMW3Chair.exe	103
PID 1572 wrote to memory of 4224	1572	MoveMW3Chair.exe	103
PID 1572 wrote to memory of 4608	1572	MoveMW3Chair.exe	104
PID 1572 wrote to memory of 4608	1572	MoveMW3Chair.exe	104
PID 1572 wrote to memory of 5048	1572	MoveMW3Chair.exe	105
PID 1572 wrote to memory of 5048	1572	MoveMW3Chair.exe	105
PID 1572 wrote to memory of 4448	1572	MoveMW3Chair.exe	106
PID 1572 wrote to memory of 4448	1572	MoveMW3Chair.exe	106
PID 1572 wrote to memory of 748	1572	MoveMW3Chair.exe	107
PID 1572 wrote to memory of 748	1572	MoveMW3Chair.exe	107
PID 1572 wrote to memory of 1428	1572	MoveMW3Chair.exe	108
PID 1572 wrote to memory of 1428	1572	MoveMW3Chair.exe	108
PID 1572 wrote to memory of 3876	1572	MoveMW3Chair.exe	109
PID 1572 wrote to memory of 3876	1572	MoveMW3Chair.exe	109

C:\Users\Admin\AppData\Local\Temp\MoveMW3Chair.exe
"C:\Users\Admin\AppData\Local\Temp\MoveMW3Chair.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\MoveMW3Chair.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\MoveMW3Chair.exe" MD5
    3⤵
    PID:3620
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:944
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color C
  2⤵
  PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Color C
  2⤵
  PID:3876

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads