1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db

Analysis

max time kernel
117s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2023, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe
Size

6KB
MD5

bbf3c156c81b7872f4033ec0060470fe
SHA1

5013a1253adc952796f7d334175554bd731f5d9d
SHA256

1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db
SHA512

7d7ac7c0d515a4e601abda7a77db336f8bed0a0cf540d0a7c5fb685cfc2a32078b637e03581b9b585513e24d3ab138418495ae4079c9b8d1e7240134d1543da4
SSDEEP

48:62IQcnLTH2pv6nfZZPg3A0TNMvU+MxIXuXjfPJdi8PFPviujFroGSTxbiKUtJ+Fr:ID24vZTQzfPlPxiu5S9OKt+4NmPzNt

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{409CB7FC-BD33-41CE-9D05-7D9B13508478}.catalogItem	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4500	2268	WerFault.exe	74

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2268	challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe
"C:\Users\Admin\AppData\Local\Temp\challange_Benign_1017e20daeb568ff78336fc6aabadb75f4a0c5ef8b3d27a16178a8d73f6f60db.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 1588
  2⤵
  - Program crash
  PID:4500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2268 -ip 2268
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nvda\userConfig\addons\remote\locale\gl\manifest.ini

Filesize
112B

MD5
af4796c9a0bada2e34c2846af99302aa

SHA1
1eeecee3d398509ae68d3d10f4acf025cc8d4961

SHA256
ac5bcd846a1f5b0fbbd3c928eee88695965f629675b188b79c084bc2047990af

SHA512
2c672d2cec0e3a2a8de738a51bf7225fdc957df5bad9007c7b25d4c1e0f977cd88a600cb040fbebd96143edde28c0f6207223f524bb008016a94c7d03506f628

Download Submit
C:\Users\Admin\AppData\Local\Temp\nvda\userConfig\addons\wintenApps\locale\mn\manifest.ini

Filesize
127B

MD5
faa1f1b57ebd8a5cd52a14a2f86e413a

SHA1
5b616617eb913c814f66d183e2d44ae0b60db021

SHA256
d03c2da424736183b58b1e880d84153da8a2db61c3d4f44bfc5d5759e84478e6

SHA512
0772de6b4ab9548f19567299041b2f6b6a48788da6cd0201a25ff9ee45244a968cbdb37dec0224baab1e5e74cc3aa11e9a211380a574e3344ae063cf0f503792

Download Submit
memory/2268-133-0x00000000007D0000-0x00000000007D8000-memory.dmp

Filesize
32KB

Download
memory/2268-134-0x0000000002B40000-0x0000000002B4A000-memory.dmp

Filesize
40KB

Download
memory/2268-135-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/2268-144-0x00000000059F0000-0x0000000005A02000-memory.dmp

Filesize
72KB

Download
memory/2268-961-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads