69b4df1c552d25d77c1e7c204f9015774c83ee5f77bb3737afbac83dc5dfb73a

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69b4df1c552d25d77c1e7c204f9015774c83ee5f77bb3737afbac83dc5dfb73a.exe
Size

293KB
MD5

d843fb4e96ef37cc536708219161360f
SHA1

61a3134dfa03687db0f427c5b922fbcf42199863
SHA256

69b4df1c552d25d77c1e7c204f9015774c83ee5f77bb3737afbac83dc5dfb73a
SHA512

cb0d1b62fc23f6a60858f78d0c979dc6f68ee2e1169bca0b442493623230a6338bea76d4d40efaeeddb0da8b670017d34b24ec533b841c308a569c11cf7a7a30
SSDEEP

6144:grk29uEo2S1YnQmCX492DkwNP3qpYF2hVIPo+BjmKUyQgSTHCG8Dr9AJ3:grkOu6/eIo4kT6FycHCGKAZ

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1152	69b4df1c552d25d77c1e7c204f9015774c83ee5f77bb3737afbac83dc5dfb73a.exe
1152	69b4df1c552d25d77c1e7c204f9015774c83ee5f77bb3737afbac83dc5dfb73a.exe
1152	69b4df1c552d25d77c1e7c204f9015774c83ee5f77bb3737afbac83dc5dfb73a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{C7CEA4E7-7548-4DCC-AA5D-7BA735C9EA2D}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{BF7ED0A3-06FA-4E8E-A074-43814E1B9E05}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

C:\Users\Admin\AppData\Local\Temp\69b4df1c552d25d77c1e7c204f9015774c83ee5f77bb3737afbac83dc5dfb73a.exe
"C:\Users\Admin\AppData\Local\Temp\69b4df1c552d25d77c1e7c204f9015774c83ee5f77bb3737afbac83dc5dfb73a.exe"
1⤵
- Loads dropped DLL
PID:1152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tsu2823A5CF.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BD4C9617-1373-4AC7-A82C-5B5166AFB4E1}\Custom.dll

Filesize
66KB

MD5
d53cae5f680dd2ed181af7d33d8cc8b6

SHA1
c1de9522515ae41b299689eba12fa09192c4a3c5

SHA256
39856115698ed45b91184f18c1343d370ed1a214b008dc13d5a132f8b461e9b7

SHA512
c04306f033f50da600cd446505557aba870a11e979d5aae214361360b5043d7df9d0b3b1da0fe3ac45cec006aec52ff3bbe6c0d08ca8090294d2c369a75c97ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BD4C9617-1373-4AC7-A82C-5B5166AFB4E1}\_Setup.dll

Filesize
160KB

MD5
3d99f53c75ee301fd7bc5abe8d883dbb

SHA1
35264d2ed3c675f152ac54045ce817693234fe06

SHA256
4ba7a5ffcfa4409eca57e201bedf9357d59a28bfd08b23081eb48f93ed8abea0

SHA512
a58054619c56b4dc1653876050a0b67df9bcffcf078b62f8cd88b96511a370e3ae9c67effc36d0b152eb5429f60eba52e5e58afca85a58527a3bf3600a89a42f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads