Analysis
-
max time kernel
123s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
25-03-2022 23:21
Behavioral task
behavioral1
Sample
1224-76-0x0000000000400000-0x0000000000429000-memory.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1224-76-0x0000000000400000-0x0000000000429000-memory.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
1224-76-0x0000000000400000-0x0000000000429000-memory.exe
-
Size
164KB
-
MD5
9b5b2f591debd15779083d452017cfad
-
SHA1
1801b4e96bf22800ab41fd57494913f71b433517
-
SHA256
1f45e9020c5227528fb02a3b2af46e2372694702f4c6df087ecfcbd8b33bb994
-
SHA512
1c34c7d3755f4d4b2ed810f3cf7467d26568710f117839f8f8d7030de5a34dfff312f61d1a753c87effcc926ca2e53a6f54ca49b1e7b90a85b6081657aac4d1d
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{415E5BD2-CEA8-4DF3-A7AD-248F7DAA99FC}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4ABA5080-271F-469A-91C1-CEFB14B04EA0}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1224-76-0x0000000000400000-0x0000000000429000-memory.exepid process 4976 1224-76-0x0000000000400000-0x0000000000429000-memory.exe 4976 1224-76-0x0000000000400000-0x0000000000429000-memory.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1224-76-0x0000000000400000-0x0000000000429000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1224-76-0x0000000000400000-0x0000000000429000-memory.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4976-134-0x0000000001110000-0x000000000145A000-memory.dmpFilesize
3.3MB