Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 21:48
Static task
static1
Behavioral task
behavioral1
Sample
02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe
Resource
win10v2004-en-20220113
General
-
Target
02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe
-
Size
13KB
-
MD5
341e51206dfcf26c5179cf39417e997a
-
SHA1
7f0d2f7bcd30c3226a792472612c0273962f6115
-
SHA256
02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c
-
SHA512
34ea58a2c93308540182bcd1d612482237d411f62f35f3bb0bf962fac24d02eafa86a7c8327c0539d0043ddf00f7c38f1f1ae04cf9d077c0e6192712cd1226c3
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\20547 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msriiwvz.scr" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 524 svchost.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe -
Drops file in Program Files directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\PROGRA~3\LOCALS~1\Temp\msriiwvz.scr svchost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exepid process 848 02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exepid process 848 02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe 848 02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exedescription pid process target process PID 848 wrote to memory of 524 848 02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe svchost.exe PID 848 wrote to memory of 524 848 02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe svchost.exe PID 848 wrote to memory of 524 848 02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe svchost.exe PID 848 wrote to memory of 524 848 02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe"C:\Users\Admin\AppData\Local\Temp\02f30494c0096b34275fe0c5fdb37e6280a82492a728712ec9b5226e86111d1c.exe"1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\syswow64\svchost.exeC:\Windows\syswow64\svchost.exe2⤵
- Adds policy Run key to start application
- Deletes itself
- Drops file in Program Files directory
PID:524