c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe
Size

57KB
MD5

172f8f458b8590b2eb430b6e33fd23d0
SHA1

2cd000a7c7843858733675f4980d4f711023e158
SHA256

c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935
SHA512

8d67f3d163860c382e91b290622f362b88c2587e6e60acfd95546276b07b32e77817b9934b4bf0dcdc7ebe10e28a095dcc3bad9ad7ac340de33d7f5f523e21b4
SSDEEP

1536:mUuXeVMdMikFVhxp2EK5X96Mb1kHSNlL0:mUuXeVMf1NJ1kHmo

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\explorer.exe	c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	explorer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	explorer.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{11DBB47C-A525-400B-9E80-A54615A090C0} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF = 01000000000000009fbeb8fc6e09d901	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "5"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerStartupTraceRecorded = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{470C0EBD-5D73-4D58-9CED-E91E22E23282} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000082cdc0fb6e09d901	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{23170F69-40C1-278A-1000-000100020000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c6f0c7fb6e09d901	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309d1a0600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1272	c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1272	c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe
1272	c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe

C:\Users\Admin\AppData\Local\Temp\c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe
"C:\Users\Admin\AppData\Local\Temp\c5f6a13df2fa54c0b9ea0cbb3af832fe7e7cea4fef6e7b523877768955350935.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1272

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...