ca2f794c7d3a1e709c9f68ac84e6a6651182ac885e01d712d562484be1879920

Analysis

max time kernel
90s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2022 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1824-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

f3ed0f2598d14a9cefbbb80bb0617116
SHA1

25cd9b9a1cc227d00916be1c4ee15bbc100327c6
SHA256

ca2f794c7d3a1e709c9f68ac84e6a6651182ac885e01d712d562484be1879920
SHA512

685acf0f9178d99453ac06e67bb44f2601b962aa7fdc87fcb61fc299b9c1ac08c0ef280123509da201d62c551839f65fddc9bb06bbf6f809b3db66b1ddb6db1d
SSDEEP

192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgw+/WVHXBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVzGQYnq/6b

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5F7972A9-3CDD-4822-9722-CB87C5DB7F4E}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{71EE77CB-5145-44EF-AA33-58B8764B2063}.catalogItem	svchost.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1532 1768 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1532	1768	WerFault.exe	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1824-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
PID:1768

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1768 -s 240
2⤵
- Program crash
PID:1532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:536

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 1768 -ip 1768
1⤵
PID:4676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads