Analysis
-
max time kernel
187s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 04:10
Static task
static1
Behavioral task
behavioral1
Sample
e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe
Resource
win10v2004-20221111-en
General
-
Target
e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe
-
Size
55KB
-
MD5
ff9024b738d98230dd31f41ca9f1c875
-
SHA1
23162a9529cce98bd20e0ce33985dc70b0cc2b04
-
SHA256
e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c
-
SHA512
0d98e28f373d08732257a94957b12d379e584f1fd9e0a77a14b0d04ac649e1278bad0927fc7dd55e51ec66652eeb94fdce2fe981f713d6fb09ddb1d234ef32ca
-
SSDEEP
768:MGziYmDTjQxWCyqQVViG1AOrsi2fPArDvLLztEq3zQMbfwq/pzA:T9+20qQVVWO14IDXe0Xbfwq/2
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\netserv\Parameters\ServiceDll = "C:\\Windows\\system32\\netservx86.dll" e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\netserv\ImagePath = "%SystemRoot%\\system32\\svchost -k netserv" e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe -
Loads dropped DLL 1 IoCs
Processes:
svchost.exepid process 4640 svchost.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exedescription ioc process File created C:\Windows\SysWOW64\netservx86.dll e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe"C:\Users\Admin\AppData\Local\Temp\e7b8bb77e38784439ceb731191b86b3782bcff3e6b620fc44eca273cb780693c.exe"1⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Drops file in System32 directory
PID:2000
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost -k netserv -s netserv1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Modifies data under HKEY_USERS
PID:4640
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5f9cc837d8cd3d197d799b3a4b8c7a847
SHA1f65f55285bb004a1c8084fe824ee2d799f27b424
SHA2561a923c160dfb182bc2e9a7ef0921624fb75cd9018564e307b7773dac83ed61c5
SHA51200cd810e4ba295e44e2db8d73a401fd8c7c5ac5538a644c07fc969b0a2712e4d932c4e79bf9d2dd657bced6021d745826d3c448059f0e8d6ec7b0a5ba5a33fe9
-
Filesize
19KB
MD5f9cc837d8cd3d197d799b3a4b8c7a847
SHA1f65f55285bb004a1c8084fe824ee2d799f27b424
SHA2561a923c160dfb182bc2e9a7ef0921624fb75cd9018564e307b7773dac83ed61c5
SHA51200cd810e4ba295e44e2db8d73a401fd8c7c5ac5538a644c07fc969b0a2712e4d932c4e79bf9d2dd657bced6021d745826d3c448059f0e8d6ec7b0a5ba5a33fe9