Analysis
- max time kernel
141s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
07/11/2022, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe
- Size 2.0MB
- Sample221107-cdtt7sccd8
- SHA256 9c2c864d63440fcd8bf74df2e09876cdff5a959829a2a8c1ad433d95247bebd5
- MD5 7a5f162423d2cf0009f3f1df45ae15c8
- SHA1 53ae99e9d18610721ee8fde61c8b7fe236882cad
- SHA512 10d3b5156569f7d7eb76c2c1053071a4a7d47a9502668c1d5233fcac4bc99dfdd92b018d2b5729aaedcbfa5b0e340b041f80e4e31f0432ab522df0282f318e3a
- SSDEEP 49152:FOcCrolwF/+UMKt2z168Y8ZLTnVSRtveduhxZd/+:Ff4nhDMKt2zrZLTV4e2/
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\filename.vbs RegSvcs.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4760 set thread context of 4132 4760 SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe 83 - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4132 RegSvcs.exe - Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 4760 wrote to memory of 4132 4760 SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe 83 PID 4760 wrote to memory of 4132 4760 SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe 83 PID 4760 wrote to memory of 4132 4760 SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe 83 PID 4760 wrote to memory of 4132 4760 SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe 83 PID 4760 wrote to memory of 4132 4760 SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe 83 PID 4760 wrote to memory of 4132 4760 SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe 83 PID 4760 wrote to memory of 4132 4760 SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe 83 PID 4760 wrote to memory of 4132 4760 SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe 83 PID 4132 wrote to memory of 4616 4132 RegSvcs.exe 87 PID 4132 wrote to memory of 4616 4132 RegSvcs.exe 87 PID 4132 wrote to memory of 4616 4132 RegSvcs.exe 87 PID 4132 wrote to memory of 4616 4132 RegSvcs.exe 87 PID 4132 wrote to memory of 4616 4132 RegSvcs.exe 87 PID 4132 wrote to memory of 2400 4132 RegSvcs.exe 88 PID 4132 wrote to memory of 2400 4132 RegSvcs.exe 88 PID 4132 wrote to memory of 2400 4132 RegSvcs.exe 88 PID 4132 wrote to memory of 2400 4132 RegSvcs.exe 88 PID 4132 wrote to memory of 2400 4132 RegSvcs.exe 88 PID 4132 wrote to memory of 2300 4132 RegSvcs.exe 89 PID 4132 wrote to memory of 2300 4132 RegSvcs.exe 89 PID 4132 wrote to memory of 2300 4132 RegSvcs.exe 89 PID 4132 wrote to memory of 2300 4132 RegSvcs.exe 89 PID 4132 wrote to memory of 2300 4132 RegSvcs.exe 89 PID 4132 wrote to memory of 2484 4132 RegSvcs.exe 90 PID 4132 wrote to memory of 2484 4132 RegSvcs.exe 90 PID 4132 wrote to memory of 2484 4132 RegSvcs.exe 90 PID 4132 wrote to memory of 2484 4132 RegSvcs.exe 90 PID 4132 wrote to memory of 2484 4132 RegSvcs.exe 90 PID 4132 wrote to memory of 3228 4132 RegSvcs.exe 91 PID 4132 wrote to memory of 3228 4132 RegSvcs.exe 91 PID 4132 wrote to memory of 3228 4132 RegSvcs.exe 91 PID 4132 wrote to memory of 3228 4132 RegSvcs.exe 91 PID 4132 wrote to memory of 3228 4132 RegSvcs.exe 91 PID 4132 wrote to memory of 4296 4132 RegSvcs.exe 92 PID 4132 wrote to memory of 4296 4132 RegSvcs.exe 92 PID 4132 wrote to memory of 4296 4132 RegSvcs.exe 92 PID 4132 wrote to memory of 4296 4132 RegSvcs.exe 92 PID 4132 wrote to memory of 4296 4132 RegSvcs.exe 92 PID 4132 wrote to memory of 3424 4132 RegSvcs.exe 93 PID 4132 wrote to memory of 3424 4132 RegSvcs.exe 93 PID 4132 wrote to memory of 3424 4132 RegSvcs.exe 93 PID 4132 wrote to memory of 3424 4132 RegSvcs.exe 93 PID 4132 wrote to memory of 3424 4132 RegSvcs.exe 93 PID 4132 wrote to memory of 4264 4132 RegSvcs.exe 94 PID 4132 wrote to memory of 4264 4132 RegSvcs.exe 94 PID 4132 wrote to memory of 4264 4132 RegSvcs.exe 94 PID 4132 wrote to memory of 4264 4132 RegSvcs.exe 94 PID 4132 wrote to memory of 4264 4132 RegSvcs.exe 94 PID 4132 wrote to memory of 2288 4132 RegSvcs.exe 95 PID 4132 wrote to memory of 2288 4132 RegSvcs.exe 95 PID 4132 wrote to memory of 2288 4132 RegSvcs.exe 95 PID 4132 wrote to memory of 2288 4132 RegSvcs.exe 95 PID 4132 wrote to memory of 2288 4132 RegSvcs.exe 95 PID 4132 wrote to memory of 2288 4132 RegSvcs.exe 95 PID 4132 wrote to memory of 2288 4132 RegSvcs.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.TVQQ.tr.4946.23043.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:4616
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:2400
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:2300
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:2484
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:3228
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:4296
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:3424
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:4264
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:2288
-
-