57a418cec9f05ae2e2c2889c255375a463640805e056eeba4542ad316d93d3b1

Analysis

max time kernel
133s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2022 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57a418cec9f05ae2e2c2889c255375a463640805e056eeba4542ad316d93d3b1.exe
Size

292KB
MD5

97fa7da58f3639e51d14c3d8a847bf87
SHA1

e1ed3682cd2f5d2b6fc309a5b2728ada203466c5
SHA256

57a418cec9f05ae2e2c2889c255375a463640805e056eeba4542ad316d93d3b1
SHA512

0c9bef03b565de60c907df8b86ba39a76f5524184c9ca1a65ba265176cdf7cf1635309d4e2a46980bba581f44c6a89ac66f1bd3ef015b9726be05409f0e434b0
SSDEEP

6144:+rkI6Y0JQBkQRl7174NpNUM+UHs+1bL28uDrexqtreJA3/fkqnZr8uyaNPl7JCu2:+rkI63yRl1uqM+gs+1+tPexUuA3/fBZk

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1152	57a418cec9f05ae2e2c2889c255375a463640805e056eeba4542ad316d93d3b1.exe
1152	57a418cec9f05ae2e2c2889c255375a463640805e056eeba4542ad316d93d3b1.exe
1152	57a418cec9f05ae2e2c2889c255375a463640805e056eeba4542ad316d93d3b1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{69FE9040-A524-4381-99C3-FC618D4B2BD9}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4D46A8DB-EFE4-4DB2-BCD2-29AAECC1D21C}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

C:\Users\Admin\AppData\Local\Temp\57a418cec9f05ae2e2c2889c255375a463640805e056eeba4542ad316d93d3b1.exe
"C:\Users\Admin\AppData\Local\Temp\57a418cec9f05ae2e2c2889c255375a463640805e056eeba4542ad316d93d3b1.exe"
1⤵
- Loads dropped DLL
PID:1152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tsu475397DF.dll

Filesize
269KB

MD5
af7ce801c8471c5cd19b366333c153c4

SHA1
4267749d020a362edbd25434ad65f98b073581f1

SHA256
cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

SHA512
88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F95D74F6-BDE0-4C83-AE68-F5C222BE5600}\Custom.dll

Filesize
62KB

MD5
3e15e552c1ae8a955bcf6ede52cec47d

SHA1
e0a7d81eb177c6ad0cd4e314d914414ec7d11dbe

SHA256
d210f4e66e5a8d0ba80dd4f76142976eedbe8c93272cd306ad980686542c0e14

SHA512
7cbe709a7f598d206b606d30cd784f828467880bea343930428d07d40ed5e7f4dd76d4e898c71643ec3079c4cf328f7ee9f0a224ca8e5dce8e87ea20f18865b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F95D74F6-BDE0-4C83-AE68-F5C222BE5600}\_Setup.dll

Filesize
162KB

MD5
bf2742e4f3af1a4c812cb6092de3f5ab

SHA1
a8a681d539d228943d8a58a126d15e735d641fcf

SHA256
e078631151b1811ead30a4d1202bd65c14fd90935df253f1bde1d25522c21a93

SHA512
61082c8f047f7a5355dd66ab3d398c53603a4e4817d8f6927675f2c0380b4555befc295f82b3389291ca07f858a74166bb123054904c77cfc950c68704787238

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads