8ca0643794a7617c822364c0a0dc50f2a3b71d84d0ac83ab77dc3b661654597a

Analysis

max time kernel
136s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2023, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2023-08-23_3e6dcb004526bb70245dd6f13b89d912_virlock_JC.exe
Size

188KB
MD5

3e6dcb004526bb70245dd6f13b89d912
SHA1

13d88d7bc20d7710fb0af90c7633f477105d3a7e
SHA256

8ca0643794a7617c822364c0a0dc50f2a3b71d84d0ac83ab77dc3b661654597a
SHA512

f9f9fec79a8494eb40cbe385f6e9abb9323434419efd9b79f853510767d1df998ac81ab20b2f30ea0e46572d81000c37f8ad6e18f9a4108c3768804fe1803994
SSDEEP

3072:MHpcl8NV8MFZeb9gtPqKuX7FMGxQJ03E1Kvfuj7kz6sHWJWetp5eEPYlGwr6sRJp:SS5QcbcGQkfGg+s9et/ehlV6s/ygTH

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F0D9BB8D-55AF-4CC3-9E1D-0E6F9498E89A}.catalogItem	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1876	4412	WerFault.exe	84

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2120

C:\Users\Admin\AppData\Local\Temp\2023-08-23_3e6dcb004526bb70245dd6f13b89d912_virlock_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-23_3e6dcb004526bb70245dd6f13b89d912_virlock_JC.exe"
1⤵
PID:4412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 224
  2⤵
  - Program crash
  PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4412 -ip 4412
1⤵
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4412-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4412-8-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads