3835a0ce825e2bc4bc642ef99614af9a84c0ee1a6e3a858035135f172ee2a17a

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3835a0ce825e2bc4bc642ef99614af9a84c0ee1a6e3a858035135f172ee2a17a.dll
Size

18KB
MD5

a1f9967e0576e5aa9e5315187e367a48
SHA1

f51094398c3851ac89a9890776d7a761192331e3
SHA256

3835a0ce825e2bc4bc642ef99614af9a84c0ee1a6e3a858035135f172ee2a17a
SHA512

63a4888e94c0f8b70f9db817e93d40f5ec4d29010a702270a314184fa7dbf83fe91f6cfecae4490ca0a5767218e00e9ac5d75c76cb32f6580d2f27a7213ed90f
SSDEEP

384:uTAKu+v5DR/AowkBvKPn1UuG5uYs0YqbWDQWy:EAKuYDR/QAuHL0

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3835a0ce825e2bc4bc642ef99614af9a84c0ee1a6e3a858035135f172ee2a17a.dll,#1
1⤵
PID:3428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads