253de8145c186c3d3ff60304eab1f23f4fdd50eb38a212c94847578226af433c

Analysis

max time kernel
133s
max time network
136s
platform
windows7_x64
resource
win7v20201028
submitted
15-03-2021 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c087a84574092eba9510c17f425853ce.exe
Size

128KB
MD5

c087a84574092eba9510c17f425853ce
SHA1

015a499f638d2c3bbb453ca98b31a3ac6203b2b7
SHA256

2a56e792c187c3b59f0f62b58dcd92d8137581ad83eeff0b86c120e78c3bba13
SHA512

68df03dc8ccc6d386f4c00c2491c0ce0e337af3f46c89bb586894901215280ec171a032b6913fe6201f92324c1cdc049f0515e9b65170352957cf0d19eec21ce

Score

7^/10

persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosdate svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosdate	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c087a84574092eba9510c17f425853ce.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aaaaaaaa = "C:\\Windows\\System32\\aaaaaaaa.exe"	c087a84574092eba9510c17f425853ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\aaaaaaaa = "C:\\Users\\Admin\\aaaaaaaa.exe"	c087a84574092eba9510c17f425853ce.exe

Drops file in System32 directory 1 IoCs

Processes:

c087a84574092eba9510c17f425853ce.exe

description ioc process

File created C:\Windows\SysWOW64\aaaaaaaa.exe c087a84574092eba9510c17f425853ce.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

c087a84574092eba9510c17f425853ce.exe

description pid process target process

PID 1668 set thread context of 1112 1668 c087a84574092eba9510c17f425853ce.exe svchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\aaaaaaaa.exe	c087a84574092eba9510c17f425853ce.exe

description	pid	process	target process
PID 1668 set thread context of 1112	1668	c087a84574092eba9510c17f425853ce.exe	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c087a84574092eba9510c17f425853ce.exe

description	pid	process	target process
PID 1668 wrote to memory of 1112	1668	c087a84574092eba9510c17f425853ce.exe	svchost.exe
PID 1668 wrote to memory of 1112	1668	c087a84574092eba9510c17f425853ce.exe	svchost.exe
PID 1668 wrote to memory of 1112	1668	c087a84574092eba9510c17f425853ce.exe	svchost.exe
PID 1668 wrote to memory of 1112	1668	c087a84574092eba9510c17f425853ce.exe	svchost.exe
PID 1668 wrote to memory of 1112	1668	c087a84574092eba9510c17f425853ce.exe	svchost.exe
PID 1668 wrote to memory of 1112	1668	c087a84574092eba9510c17f425853ce.exe	svchost.exe
PID 1668 wrote to memory of 1112	1668	c087a84574092eba9510c17f425853ce.exe	svchost.exe
PID 1668 wrote to memory of 1112	1668	c087a84574092eba9510c17f425853ce.exe	svchost.exe
PID 1668 wrote to memory of 1112	1668	c087a84574092eba9510c17f425853ce.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\c087a84574092eba9510c17f425853ce.exe
"C:\Users\Admin\AppData\Local\Temp\c087a84574092eba9510c17f425853ce.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:1112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-3-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1112-4-0x0000000009504E30-mapping.dmp

Download
memory/1112-5-0x0000000009500000-0x0000000009508000-memory.dmp

Filesize
32KB

Download
memory/1668-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download