7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82

General

Target

7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
Size

1.6MB
MD5

924353667281c239470e4762d50f6bcd
SHA1

26df77a020ea2fd245a340d858872992cf8f2a4b
SHA256

7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82
SHA512

120d7d5ad78d95ee481a11b2e7acddecd7487a82eec9ed45b0855bac0ce561b73a453208263ea93a3b893fde10958b28a1bb3bd7b4cf0f1b610d4b0fbceb33f7
SSDEEP

24576:BzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUY+:T6/ye0PIphrp9Zuvjqa0UidB

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{76F494A9-407D-4775-A6AD-FAF69B796839}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{33F194E4-5258-47E5-B663-9B7B9B45139B}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe

description	pid	process	target process
PID 1404 set thread context of 2380	1404	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe

pid	process
2380	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
2380	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
2380	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
2380	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
2380	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe

description	pid	process	target process
PID 1404 wrote to memory of 2380	1404	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
PID 1404 wrote to memory of 2380	1404	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
PID 1404 wrote to memory of 2380	1404	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
PID 1404 wrote to memory of 2380	1404	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
PID 1404 wrote to memory of 2380	1404	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
PID 1404 wrote to memory of 2380	1404	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
PID 1404 wrote to memory of 2380	1404	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
PID 1404 wrote to memory of 2380	1404	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
PID 1404 wrote to memory of 2380	1404	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
PID 1404 wrote to memory of 2380	1404	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe	7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe

C:\Users\Admin\AppData\Local\Temp\7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
"C:\Users\Admin\AppData\Local\Temp\7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe
"C:\Users\Admin\AppData\Local\Temp\7f87d3f3e9b3fb63e29bfaa5162ff8c051325efb3871dadf53fbd7a554b0ff82.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-132-0x0000000000000000-mapping.dmp

Download
memory/2380-133-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2380-134-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2380-135-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2380-136-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2380-137-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/2380-138-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads