ce19c1a4e7aa5b2160392a6529452556b8f371c0103f844632397a9f7535dfa8

Resubmissions

14/02/2023, 06:53

230214-hnx79sbe26 5

14/02/2023, 06:08

230214-gv83nsaf4y 5

Analysis

max time kernel
1710s
max time network
1199s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2023, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WDTransport.dll
Size

86KB
MD5

fff2967260ceb063302e07daef60de1e
SHA1

77e1a8508e0d03c243d49b0ef5a11139a9d6ded7
SHA256

b7498afb54dd3bd52bd3ca1f4eb3bfe04bdafa958f9b690627c83a51f7b7dfd2
SHA512

56330a6ff0c2c09bb1c69c5886bd7cc9e05a69b6207b9466d9ad04deb3b53e566b4cc84ca84e059631edc20f232055dabd3bae3746be3d1dae113bb4501cce3c
SSDEEP

1536:dpClMuUZ9EmNuE7p2ZdLwBW2kjM2bgksU4uaSieywuwz/AhL:CCHEm8E7p2ZdLX2kjrbgksUiepdO

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5C790EBA-6399-4393-B93F-DD975EA30399}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{13E8D50D-2C1F-4177-92F1-289033349345}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WDTransport.dll,#1
1⤵
PID:2228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads