faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e

General

Target

faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e.exe
Size

312KB
MD5

0dec3af6fc9db29491413e43d72edbe9
SHA1

73080d8daca0fd5d45c7b9867127dfbe69a25f87
SHA256

faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e
SHA512

0ff89a3021e91a49bbc817cb4d79e3aa05672d39a9cc7ef2b8e0ac4f52b67d24510c4e2543e265103c8c80900888276ee356e030a65d57f870064a582b07a7de
SSDEEP

6144:D+K0zo6YpSSShM7g2rjx85GPRV94CsTAdyYmN6SgdtPu24cb9sYA:qzLSFs+jxEkV9UsdyYmwjm2794

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2228	faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e.exe
2228	faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e.exe
2228	faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e.exe
2228	faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e.exe
2228	faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e.exe
2228	faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e.exe
2228	faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{1453C46F-5DA7-4FE6-936D-2026A59D5DB2}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{DC9788A2-79AD-4538-9B7C-2EA139A486D0}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

C:\Users\Admin\AppData\Local\Temp\faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e.exe
"C:\Users\Admin\AppData\Local\Temp\faa66a3ac0ec1aa0bcbd798d0ac956b0334b804e07a796728d8e6226ef68229e.exe"
1⤵
- Loads dropped DLL
PID:2228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsyF775.tmp\nsisdl.dll

Filesize
14KB

MD5
1dadb63a5dfaa0679485c5dbaf96033f

SHA1
d1717aab683c55bd13bbd520d2a91178efa0d676

SHA256
72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

SHA512
46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF775.tmp\nsisdl.dll

Filesize
14KB

MD5
1dadb63a5dfaa0679485c5dbaf96033f

SHA1
d1717aab683c55bd13bbd520d2a91178efa0d676

SHA256
72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

SHA512
46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF775.tmp\nsisdl.dll

Filesize
14KB

MD5
1dadb63a5dfaa0679485c5dbaf96033f

SHA1
d1717aab683c55bd13bbd520d2a91178efa0d676

SHA256
72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

SHA512
46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF775.tmp\nsisdl.dll

Filesize
14KB

MD5
1dadb63a5dfaa0679485c5dbaf96033f

SHA1
d1717aab683c55bd13bbd520d2a91178efa0d676

SHA256
72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

SHA512
46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF775.tmp\nsisdl.dll

Filesize
14KB

MD5
1dadb63a5dfaa0679485c5dbaf96033f

SHA1
d1717aab683c55bd13bbd520d2a91178efa0d676

SHA256
72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

SHA512
46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF775.tmp\nsisdl.dll

Filesize
14KB

MD5
1dadb63a5dfaa0679485c5dbaf96033f

SHA1
d1717aab683c55bd13bbd520d2a91178efa0d676

SHA256
72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

SHA512
46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF775.tmp\nsisdl.dll

Filesize
14KB

MD5
1dadb63a5dfaa0679485c5dbaf96033f

SHA1
d1717aab683c55bd13bbd520d2a91178efa0d676

SHA256
72c65f7cd4a611b077b1ad0be8185780909e9cb04c53ecdac3e17fc72c99b245

SHA512
46535c2d96937d49ee7c222428db4a8d61eb346efa0845fcd88e06523ed7836518e5a72d623e9c5563bf6759b449b6d2fcb0340b98a6e7966027bc983db4f722

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads