Analysis
-
max time kernel
123s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 06:43
Behavioral task
behavioral1
Sample
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe
Resource
win10v2004-20220812-en
General
-
Target
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe
-
Size
307KB
-
MD5
3498c294883156b4076ce82826b1591d
-
SHA1
99167ba4c13df8c3da314ad8e257022539669c7f
-
SHA256
b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc
-
SHA512
96b24265da685ce6f14a9c979c67140befcc3d82fe8a4402edd5875040ded2fe562e85864506b384899e707d9b253421d56d7a1f0931c01eba5b76248d9dae5e
-
SSDEEP
6144:2qzIT72Y0S+zinYKTY1SQshfRPVQe1MZkIYSccr7wbstOEPECYeixlYGicMX:2Ck7SSpYsY1UMqMZJYSN7wbstOE8fve9
Malware Config
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{7711AC5E-E12A-437B-9EDB-2442B29852F3}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{29F746FE-8D01-418C-B419-EC7338E58A9B}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe"C:\Users\Admin\AppData\Local\Temp\b7a449375a54c27c67232a59691ae2fc5a3751feea238f8e3dc89b367a2e5bcc.exe"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry