Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
31-05-2022 01:13
Static task
static1
Behavioral task
behavioral1
Sample
07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe
Resource
win10v2004-20220414-en
General
-
Target
07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe
-
Size
164KB
-
MD5
01301b7e7aea87b2d23495498e67c58c
-
SHA1
bdab9012d9beace67af9ba590764f0ea8ddda4ff
-
SHA256
07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e
-
SHA512
cfc22be78cc207523019cf917b03b75f9346c1c408c0d2a2f6b18a89f0ad83757e638b44024638c9bcbf8d1b6b2df0aa899826d49e81bfe14e74f0a247eef477
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{AB736743-8423-4558-82F5-A4E2FC405A3E}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{BC2258AD-9456-42BA-808F-13120DD6A4C2}.catalogItem svchost.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1276 432 WerFault.exe 07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe"C:\Users\Admin\AppData\Local\Temp\07a2e5f21264d00977be94980f6fa46c0e955b7cf312092634a2d3f1bbd3c39e.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 2322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 432 -ip 4321⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry