Analysis
-
max time kernel
201s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 22:25
Static task
static1
Behavioral task
behavioral1
Sample
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe
Resource
win10v2004-20221111-en
General
-
Target
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe
-
Size
119KB
-
MD5
46e1676cfc354dae4ae457773d20c2b2
-
SHA1
6515f574701e101b7df0b6306671cb70800359eb
-
SHA256
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348
-
SHA512
1e04f78a01558c6f3e7d6fef718ed3da6559be7185c92f78d9e24b2b3731b2e9b974b5b1f3f0dde63e5116a155c86a60852eff53fb6c726f9cb5590c07c94489
-
SSDEEP
1536:TwbIdIdbNCPoWaPEnw3XW4nKyXsseoiepwQRfl16p8eZk7qjh3rmKPNRsbA5:EPNYnkG4nKyjjw0fGqeZ7jZqMNRsE5
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosdate svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aaaaaaaa = "C:\\Windows\\System32\\aaaaaaaa.exe" 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aaaaaaaa = "C:\\Users\\Admin\\aaaaaaaa.exe" 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe -
Drops file in System32 directory 1 IoCs
Processes:
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exedescription ioc process File created C:\Windows\SysWOW64\aaaaaaaa.exe 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exedescription pid process target process PID 1780 set thread context of 3772 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe PID 3772 set thread context of 5052 3772 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier svchost.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exepid process 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exedescription pid process target process PID 1780 wrote to memory of 3772 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe PID 1780 wrote to memory of 3772 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe PID 1780 wrote to memory of 3772 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe PID 1780 wrote to memory of 3772 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe PID 1780 wrote to memory of 3772 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe PID 1780 wrote to memory of 3772 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe PID 1780 wrote to memory of 3772 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe PID 1780 wrote to memory of 3772 1780 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe PID 3772 wrote to memory of 5052 3772 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe svchost.exe PID 3772 wrote to memory of 5052 3772 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe svchost.exe PID 3772 wrote to memory of 5052 3772 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe svchost.exe PID 3772 wrote to memory of 5052 3772 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe svchost.exe PID 3772 wrote to memory of 5052 3772 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe svchost.exe PID 3772 wrote to memory of 5052 3772 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe svchost.exe PID 3772 wrote to memory of 5052 3772 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe svchost.exe PID 3772 wrote to memory of 5052 3772 8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe"C:\Users\Admin\AppData\Local\Temp\8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe"C:\Users\Admin\AppData\Local\Temp\8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe3⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1780-135-0x0000000000500000-0x0000000000505000-memory.dmpFilesize
20KB
-
memory/3772-132-0x0000000000000000-mapping.dmp
-
memory/3772-133-0x0000000013100000-0x000000001310A000-memory.dmpFilesize
40KB
-
memory/3772-136-0x0000000013100000-0x000000001310A000-memory.dmpFilesize
40KB
-
memory/3772-139-0x0000000013100000-0x000000001310A000-memory.dmpFilesize
40KB
-
memory/5052-137-0x0000000000000000-mapping.dmp
-
memory/5052-138-0x0000000009500000-0x0000000009508000-memory.dmpFilesize
32KB
-
memory/5052-141-0x0000000009500000-0x0000000009508000-memory.dmpFilesize
32KB
-
memory/5052-142-0x0000000009500000-0x0000000009508000-memory.dmpFilesize
32KB