5ff52ab9349cd6d7a7fc0d2596c3423cdfb5df668b363fb93bd686f9ab198910 | Triage

Analysis

max time kernel
137s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2023 08:30

Sharing

Report Analysis Logs

General

Target

2111.exe
Size

50KB
MD5

175ac1e037521a1d29bffe5abe0d9d92
SHA1

4a1f499e862abb46bd9f3e21f80186704e441df5
SHA256

5ff52ab9349cd6d7a7fc0d2596c3423cdfb5df668b363fb93bd686f9ab198910
SHA512

c2bfdb5b038b577a4a1b06e7cdf4d0215448591ccabeb98531bb7fd03dac569a99fa8ed056b8b1df4bc45b0293d0746ef0b94028844cb0a59724e9ca8d29ad67
SSDEEP

768:TVcCo1dt4cybqx7P9vm9Rg6+E7apmW8msk:T2t4cybq56O84

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 8 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F98E8895-B9A9-4458-9C8E-8368D19724FA}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{2AEB7281-A308-425B-BEB7-38CE587D685F}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{29D9D8E8-B0FE-4368-897B-ABE79EBB903E}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4EE0DBFA-5CEB-46AB-90D1-8FAFD76262AF}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6ED0F582-1C74-4423-9CEF-7C8237E8D24D}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{03606412-7324-416E-A16A-8A9FF839EC87}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{C359640C-DA01-4E20-A891-E42447FC8139}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{AD6898AE-F3F1-4246-8CC6-0A0B9E275960}.catalogItem	svchost.exe

C:\Users\Admin\AppData\Local\Temp\2111.exe
"C:\Users\Admin\AppData\Local\Temp\2111.exe"
1⤵
PID:3316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads