70cf119b0a17fd0d3a2e7668693c9a41f2ee59b5037b691dad9b2151126123ef

Analysis

max time kernel
138s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70cf119b0a17fd0d3a2e7668693c9a41f2ee59b5037b691dad9b2151126123ef.exe
Size

206KB
MD5

011711065387d89673035cb6d27ddfbb
SHA1

b37ccdc7a278fe0a007bc6cf5ad097d0788f2eee
SHA256

70cf119b0a17fd0d3a2e7668693c9a41f2ee59b5037b691dad9b2151126123ef
SHA512

2ce5c4f7dc8a0188f0e3ba4c4200dd03b247dc0c0f6cff55d1f0460cb0f073d2817ec805cf619330639299b15867be3b1117e22725010999f050e95aa220e78d
SSDEEP

6144:tu7XQyUMjLzilgUOclNA3FQ1qgz6FaCXe7Zgm8U:YtqFnlGVgz6YQe7M

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1564	70cf119b0a17fd0d3a2e7668693c9a41f2ee59b5037b691dad9b2151126123ef.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sshnas21.dll	70cf119b0a17fd0d3a2e7668693c9a41f2ee59b5037b691dad9b2151126123ef.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{DCC86491-C37E-4CDC-B890-9157F5153B94}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{554CC353-3315-46E4-AF1F-D08A97C86313}.catalogItem	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3080	1564	WerFault.exe	74

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1564	70cf119b0a17fd0d3a2e7668693c9a41f2ee59b5037b691dad9b2151126123ef.exe

C:\Users\Admin\AppData\Local\Temp\70cf119b0a17fd0d3a2e7668693c9a41f2ee59b5037b691dad9b2151126123ef.exe
"C:\Users\Admin\AppData\Local\Temp\70cf119b0a17fd0d3a2e7668693c9a41f2ee59b5037b691dad9b2151126123ef.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 736
  2⤵
  - Program crash
  PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1564 -ip 1564
1⤵
PID:2440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sshnas21.dll

Filesize
170KB

MD5
5428c28da82f82ace85defc2d63e21d9

SHA1
c72535b036d16942a46e5f9b75a3e39ce253a2ac

SHA256
e1e724b05e1e3e5166b857aafb4d8e5e394b7502b7e9734fbbc8019a625768bd

SHA512
a5c7d43519059f22cea63c51287cd2529967e993c45ea6ae64d2484fa929f67cf855f4ce3a9c539a2490a7a9646743243b952cdb10da4a3e9a54890fb46baf31

Download Submit
memory/1564-132-0x00000000006D0000-0x00000000006F9000-memory.dmp

Filesize
164KB

Download
memory/1564-133-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1564-135-0x0000000002260000-0x0000000002286000-memory.dmp

Filesize
152KB

Download
memory/1564-136-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads