0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4

Analysis

max time kernel
154s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe
Size

1.7MB
MD5

1a6b5ad98206becab7e8360da4f31df6
SHA1

4b2b096c9045cbe5f750bdfb31922fda1bf82f87
SHA256

0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4
SHA512

d94edc7a0c060744c08578452b3ebe1c33e5a85c24d123f924ea9129d6bc87c5fe713c8bb5be05eff2689d75742a62a6936773a1a25587692631033edca4e59a
SSDEEP

49152:jv/B1SbWp6wHkPJHEbZDTaIuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuTuuuuuua:jvZ1ScQxHE1ruuuuuuuuuuuuuuuuuuum

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4320	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.hwd
4876	SERVICEMGR.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "C:\\Windows\\system32\\SERVICEMGR.EXE"	SERVICEMGR.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Manager = "C:\\Windows\\system32\\SERVICEMGR.EXE"	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SERVICEMGR.EXE	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.hwd
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.hwd

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1952	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe
4876	SERVICEMGR.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4320	1952	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe	81
PID 1952 wrote to memory of 4320	1952	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe	81
PID 1952 wrote to memory of 4320	1952	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe	81
PID 1952 wrote to memory of 4876	1952	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe	82
PID 1952 wrote to memory of 4876	1952	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe	82
PID 1952 wrote to memory of 4876	1952	0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe	82

C:\Users\Admin\AppData\Local\Temp\0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe
"C:\Users\Admin\AppData\Local\Temp\0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.hwd
  C:\Users\Admin\AppData\Local\Temp\0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.hwd
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4320
- C:\Windows\SysWOW64\SERVICEMGR.EXE
  C:\Windows\system32\SERVICEMGR.EXE
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:4876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.hwd

Filesize
1.6MB

MD5
c2d42861ede1d21beaf40e31423d5eda

SHA1
a50c4713b33fb8e57a562af02799604767b4882b

SHA256
8d90ad42fc89076da1ea0dd748228b0a12ea7362dc64497485862213d5f3b86e

SHA512
78c1abca0c8bf55a3ecde2abc731343c36752f07c4d1d0889361487221b44bd3a04c1832e9832d5f7da0b5156d1a0883201e13cf4f73503ecc56aaa34aff8685

Download Submit
C:\Users\Admin\AppData\Local\Temp\0dd37d9452c9679386b0a945da45d4ea43b71f4fbcc26ab9a4736ec47b42c0b4.hwd

Filesize
1.6MB

MD5
c2d42861ede1d21beaf40e31423d5eda

SHA1
a50c4713b33fb8e57a562af02799604767b4882b

SHA256
8d90ad42fc89076da1ea0dd748228b0a12ea7362dc64497485862213d5f3b86e

SHA512
78c1abca0c8bf55a3ecde2abc731343c36752f07c4d1d0889361487221b44bd3a04c1832e9832d5f7da0b5156d1a0883201e13cf4f73503ecc56aaa34aff8685

Download Submit
C:\Windows\SysWOW64\SERVICEMGR.EXE

Filesize
76KB

MD5
2e718da19d6fed99afd7ef91288536fb

SHA1
566cbf915d195e5d98365c0267eb24047fe190f1

SHA256
6a30d1f3554f100ea5d83e93f1a1c3ab717df0f5a9134a9ee74708c2ec0c935c

SHA512
951f57ab06a179d606232a1b010c00e4ff365e4b6541dd28df78b15c27e2ce44868094b56df0b744767dbc3761fc3b65d7e23d80b0e7b13533bd279ac4c24e55

Download Submit
C:\Windows\SysWOW64\SERVICEMGR.EXE

Filesize
76KB

MD5
2e718da19d6fed99afd7ef91288536fb

SHA1
566cbf915d195e5d98365c0267eb24047fe190f1

SHA256
6a30d1f3554f100ea5d83e93f1a1c3ab717df0f5a9134a9ee74708c2ec0c935c

SHA512
951f57ab06a179d606232a1b010c00e4ff365e4b6541dd28df78b15c27e2ce44868094b56df0b744767dbc3761fc3b65d7e23d80b0e7b13533bd279ac4c24e55

Download Submit