Analysis
-
max time kernel
179s -
max time network
191s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 21:46
Static task
static1
Behavioral task
behavioral1
Sample
7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe
Resource
win10v2004-20221111-en
General
-
Target
7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe
-
Size
36KB
-
MD5
d9c18d877da8c5af09ff8b7b324159a2
-
SHA1
d8516dc1cc110b124e95351d8314f9b22d06d10f
-
SHA256
7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe
-
SHA512
32d411288b7ced021d1c52bfdc32a1f9cb7519ca8d8b792ee0fd90a40214e4001da856e06c03b59778375bc7ce5b88c0fc68dd812cd416c6ea61719255073a6c
-
SSDEEP
384:iT0stOBGVoai42YrTY5MxzqM1+8ALN76QXaC/DmynlSV9Q2dc7:iAJHNu8M5qu+NUC/dlg9RW7
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\35566 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msumpwv.com" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1972 svchost.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe -
Drops file in Program Files directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\PROGRA~3\LOCALS~1\Temp\msumpwv.com svchost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exepid process 1940 7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exepid process 1940 7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe 1940 7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exepid process 1940 7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exedescription pid process target process PID 1940 wrote to memory of 1972 1940 7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe svchost.exe PID 1940 wrote to memory of 1972 1940 7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe svchost.exe PID 1940 wrote to memory of 1972 1940 7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe svchost.exe PID 1940 wrote to memory of 1972 1940 7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe"C:\Users\Admin\AppData\Local\Temp\7563b1551c36956417362ad96b1b19a605807de049c659ac00af4e0e2b411afe.exe"1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\syswow64\svchost.exeC:\Windows\syswow64\svchost.exe2⤵
- Adds policy Run key to start application
- Deletes itself
- Drops file in Program Files directory
PID:1972
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1940-54-0x0000000000220000-0x0000000000225000-memory.dmpFilesize
20KB
-
memory/1940-55-0x0000000000230000-0x000000000023D000-memory.dmpFilesize
52KB
-
memory/1940-56-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1940-58-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1972-57-0x0000000000000000-mapping.dmp
-
memory/1972-59-0x0000000000660000-0x0000000000668000-memory.dmpFilesize
32KB
-
memory/1972-60-0x0000000000080000-0x0000000000085000-memory.dmpFilesize
20KB
-
memory/1972-61-0x0000000000020000-0x0000000000025000-memory.dmpFilesize
20KB
-
memory/1972-62-0x0000000000020000-0x0000000000025000-memory.dmpFilesize
20KB