0ad51c1958412d2015772aa52098033e005f7ba272fb25f3b472be041edbdc80

Analysis

max time kernel
153s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ad51c1958412d2015772aa52098033e005f7ba272fb25f3b472be041edbdc80.exe
Size

23KB
MD5

6c2d3fcf3d387ede61ce33a2537d4068
SHA1

1ad5eaef197cf81a9be50d1681cc702a528e442e
SHA256

0ad51c1958412d2015772aa52098033e005f7ba272fb25f3b472be041edbdc80
SHA512

1912ed26cb37e0b884bd5d7b1e0ea9cb50c7a30de6e75aace8363d0ecee231d2ea21475f42515835cda45067ba8ecd98220ae31e8ad2a6317b558aaff6ee27e2
SSDEEP

192:yZcGI6wHmX4cTf8bAKJcbsQg9NGYqtCf/JMGxEdvwNkAXNkb4FUIPmktWO7lN6lY:u5IhH24cU0YqMyVqPPmktb2/Tg4bw

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F8005987-8E12-49BE-954D-C5F1B304A6E2}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{CE775C71-3E06-416E-882A-44CF6101AED6}.catalogItem	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4620	4424	WerFault.exe	76

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

C:\Users\Admin\AppData\Local\Temp\0ad51c1958412d2015772aa52098033e005f7ba272fb25f3b472be041edbdc80.exe
"C:\Users\Admin\AppData\Local\Temp\0ad51c1958412d2015772aa52098033e005f7ba272fb25f3b472be041edbdc80.exe"
1⤵
PID:4424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 268
  2⤵
  - Program crash
  PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4424 -ip 4424
1⤵
PID:2644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads