7cb650b8be8d07cca3bb7b7dfa77998b917b668491fcbab77dc38ddb246de069

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cb650b8be8d07cca3bb7b7dfa77998b917b668491fcbab77dc38ddb246de069.exe
Size

60KB
MD5

048a7a2cc49794cb11f7b033c9390cd3
SHA1

2cf835e6f254f6862a2320879dc3ea8976d68b9c
SHA256

7cb650b8be8d07cca3bb7b7dfa77998b917b668491fcbab77dc38ddb246de069
SHA512

807f238ae4933ff9f40d14c93d959ad6c69b7950c7a92df07519ac5b3a2185b539e2fa67932c350e8f3ba69a0a7c88ecb8317c143ef13d100d21d161629648f8
SSDEEP

1536:CY5IVqNE8QjmoJ1Zj/fBgaIgdPexfAgVV/cMCEoT:ZAqNE8QjmoJnr6ay6yVW7T

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\ÓÐ³¯Ò»ÈÕÈ¨ÔÚÊÖ£¬É±¾¡ÌìÏÂª¨ÜÀ«¥\Parameters\ServiceDll = "%SystemRoot%\\System32\\hwnswk.dll"	7cb650b8be8d07cca3bb7b7dfa77998b917b668491fcbab77dc38ddb246de069.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\ÓÐ³¯Ò»ÈÕÈ¨ÔÚÊÖ£¬É±¾¡ÌìÏÂª¨ÜÀ«¥\Parameters\ServiceDll = "%SystemRoot%\\System32\\hwnswk.dll"	7cb650b8be8d07cca3bb7b7dfa77998b917b668491fcbab77dc38ddb246de069.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ÓÐ³¯Ò»ÈÕÈ¨ÔÚÊÖ£¬É±¾¡ÌìÏÂª¨ÜÀ«¥\Parameters\ServiceDll = "%SystemRoot%\\System32\\hwnswk.dll"	7cb650b8be8d07cca3bb7b7dfa77998b917b668491fcbab77dc38ddb246de069.exe

Deletes itself 1 IoCs

pid	Process
1116	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
112	7cb650b8be8d07cca3bb7b7dfa77998b917b668491fcbab77dc38ddb246de069.exe
1116	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\0006c604.ini	7cb650b8be8d07cca3bb7b7dfa77998b917b668491fcbab77dc38ddb246de069.exe
File created	C:\Windows\SysWOW64\hwnswk.dll	7cb650b8be8d07cca3bb7b7dfa77998b917b668491fcbab77dc38ddb246de069.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1116	svchost.exe
1116	svchost.exe
1116	svchost.exe

C:\Users\Admin\AppData\Local\Temp\7cb650b8be8d07cca3bb7b7dfa77998b917b668491fcbab77dc38ddb246de069.exe
"C:\Users\Admin\AppData\Local\Temp\7cb650b8be8d07cca3bb7b7dfa77998b917b668491fcbab77dc38ddb246de069.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:112

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k ÓÐ³¯Ò»ÈÕÈ¨ÔÚÊÖ£¬É±¾¡ÌìÏÂª¨ÜÀ«¥
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\hwnswk.dll

Filesize
93KB

MD5
aef61d0674b292401c93c91070ade141

SHA1
6a4825de29d0faadd14483eaa75113e4a0ff8962

SHA256
ad93f2f2200374a78f21a2d4077df10726b0f48c49f81b50518711f95a62e935

SHA512
831220984d2487a81401e7a9f24dbc4aa7b22782f4ce6a4e891c037edd821c672c5888cd9bc02038e0c414d1882d872907d784970b0201a6405d897b48eadafe

Download Submit
\Windows\SysWOW64\hwnswk.dll

Filesize
93KB

MD5
aef61d0674b292401c93c91070ade141

SHA1
6a4825de29d0faadd14483eaa75113e4a0ff8962

SHA256
ad93f2f2200374a78f21a2d4077df10726b0f48c49f81b50518711f95a62e935

SHA512
831220984d2487a81401e7a9f24dbc4aa7b22782f4ce6a4e891c037edd821c672c5888cd9bc02038e0c414d1882d872907d784970b0201a6405d897b48eadafe

Download Submit
\Windows\SysWOW64\hwnswk.dll

Filesize
93KB

MD5
aef61d0674b292401c93c91070ade141

SHA1
6a4825de29d0faadd14483eaa75113e4a0ff8962

SHA256
ad93f2f2200374a78f21a2d4077df10726b0f48c49f81b50518711f95a62e935

SHA512
831220984d2487a81401e7a9f24dbc4aa7b22782f4ce6a4e891c037edd821c672c5888cd9bc02038e0c414d1882d872907d784970b0201a6405d897b48eadafe

Download Submit
memory/112-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download