bcf6858f0b8d1ec274bb85de4cf845831c9368a8ed0d5910ae3fadfe1ba89c1b

Analysis

max time kernel
120s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bcf6858f0b8d1ec274bb85de4cf845831c9368a8ed0d5910ae3fadfe1ba89c1b.exe
Size

294KB
MD5

a2711b80448a0a2bd56ffc1a6ae5920c
SHA1

bb69b29a24976643cac6fb131d492edb890a216c
SHA256

bcf6858f0b8d1ec274bb85de4cf845831c9368a8ed0d5910ae3fadfe1ba89c1b
SHA512

9837d6e257bc0cae7bd58f1384c4de0252357801502e7400873116aee388282361c56582016a82319f821417df3f7aaa21b4f9323de5f28639643b191d3490ab
SSDEEP

6144:owj9g+/OOd0FkybrtLU1DhgD6Mhu52UGt:XjG++FkV1DhgD6v2nt

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{36E103C4-923F-4A41-B1C2-4F7837146C1D}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A99A3A1D-CADC-4DE4-B978-7B90988537CD}.catalogItem	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\FuelDuel.job	bcf6858f0b8d1ec274bb85de4cf845831c9368a8ed0d5910ae3fadfe1ba89c1b.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

C:\Users\Admin\AppData\Local\Temp\bcf6858f0b8d1ec274bb85de4cf845831c9368a8ed0d5910ae3fadfe1ba89c1b.exe
"C:\Users\Admin\AppData\Local\Temp\bcf6858f0b8d1ec274bb85de4cf845831c9368a8ed0d5910ae3fadfe1ba89c1b.exe"
1⤵
- Drops file in Windows directory
PID:3036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3036-132-0x0000000003DA0000-0x0000000003DCF000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads