37115878c12ddfa17f6a49d8ff2a9778a5deaa0cbf2de0909bf689410dce1d8f

Analysis

max time kernel
162s
max time network
270s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2022, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Unlock{Full_Version}/bin/win64/libEGL.dll
Size

203KB
MD5

fee39269772633d85ad1ebf4d93611b3
SHA1

915f067094dd1dd3dbe42f3acb53a8becb81b151
SHA256

a974a768c54395a1f00ca5a690c86732ff82f82eec26faa3c4c87cd5322d513d
SHA512

6dc1a70a86d4a3326c2fd8b0775312688c2cfeab7d16d6c4fabc3f6c6c4c0adf715369ac91691b23ed1a741953914b6739b2b050ee428ae963c3aa64c2aab00a
SSDEEP

3072:K3yiHbZ85o+aolTx7H1TQOyRq3uBuUEj+0Y026O+bfEa:AHt87aolT9ahRq+IjZb8

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6A49E914-FB4F-4457-95B6-71E84F7577CB}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F7D4DDCC-DA0E-423C-BC54-B708CEC0D28C}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Unlock{Full_Version}\bin\win64\libEGL.dll,#1
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads