Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07-07-2023 12:23
Behavioral task
behavioral1
Sample
4844e3252cea0bexeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
4844e3252cea0bexeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
4844e3252cea0bexeexeexeex.exe
-
Size
335KB
-
MD5
4844e3252cea0bbad442b72e8ba34b7b
-
SHA1
d9335d4006028e7e48b5ecfbad5eb8917ec630a7
-
SHA256
d34b14b9abbc0dcb5fb4ca9475699a0c39f90351793dbcede2993ad633817a75
-
SHA512
4280ae1ba51f3d2fd2d58970352143cde9b7a57f02a7ea753f224c4fa34bd7aa16312e28d92740d1e3a53f6fe16c6e227373d6f20744b0e3a077c9898c67ed04
-
SSDEEP
6144:qtUGfUWOeEBUEhLkXj3zRG6yLQ/UNP4H2CiTTS10qhh43Ajrt:qtUGfVwUFzRG6EQ0POfiTTa0qSAjrt
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{EF9164DF-5C86-47D6-8BCD-4B3AB3EEF85A}.catalogItem svchost.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1848 816 WerFault.exe 4844e3252cea0bexeexeexeex.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4844e3252cea0bexeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\4844e3252cea0bexeexeexeex.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 3762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 816 -ip 8161⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry