8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951

General

Target

8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
Size

1.6MB
MD5

cddd3cd8fff59a226ad6ba7312f4748b
SHA1

9254118228dcc6276d44464f4d3093810a114648
SHA256

8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951
SHA512

9d7a04699edaa23fe033a984a70615de0c973894fbd1c9d7cc21017fa058932f839c5d8feeb42eba256ea5cff04ddb4b57d39ff1f0c74ec93a3117f142cc3e89
SSDEEP

24576:tzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYj:H6/ye0PIphrp9Zuvjqa0Uid4

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F4E19024-2903-469B-8A6E-F4991AD9E213}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E32646B4-3D4F-4483-87FC-39F68C7B776E}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe

description	pid	process	target process
PID 1544 set thread context of 2380	1544	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe

pid	process
2380	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
2380	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
2380	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
2380	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
2380	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe

description	pid	process	target process
PID 1544 wrote to memory of 2380	1544	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
PID 1544 wrote to memory of 2380	1544	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
PID 1544 wrote to memory of 2380	1544	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
PID 1544 wrote to memory of 2380	1544	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
PID 1544 wrote to memory of 2380	1544	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
PID 1544 wrote to memory of 2380	1544	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
PID 1544 wrote to memory of 2380	1544	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
PID 1544 wrote to memory of 2380	1544	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
PID 1544 wrote to memory of 2380	1544	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
PID 1544 wrote to memory of 2380	1544	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe	8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe

C:\Users\Admin\AppData\Local\Temp\8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
"C:\Users\Admin\AppData\Local\Temp\8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe
"C:\Users\Admin\AppData\Local\Temp\8b715001288e4bbc264ffb6e8cc4fe2ae7b2eca5a5b011e7b31185745e988951.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-132-0x0000000000000000-mapping.dmp

Download
memory/2380-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2380-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2380-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2380-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2380-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads