22562822d239afdee4e975bd2ea9864cf21b28c443cda9755ea4b7cc93ec2783

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
04-09-2023 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22562822d239afdee4e975bd2ea9864cf21b28c443cda9755ea4b7cc93ec2783.exe
Size

3.7MB
MD5

5e1213ea57e9e994d57cd9657a11b755
SHA1

cd0bd1f3ffb4b0294d9fd14cbd04d49d68e039fe
SHA256

22562822d239afdee4e975bd2ea9864cf21b28c443cda9755ea4b7cc93ec2783
SHA512

2e6a72a2aefeb162a5ee7cf5989d546f6439e74bfd38ed39fe40d86165ebb38d1496357606822bd225741876165b9eb45862719a959425c7a372a71025761738
SSDEEP

49152:WhQ8lPzRnZp4y5C6mB0j4KTB+r5u8QeKxFOJxdb4vZKV8:SllLRnZp4yE6mdVKdzOJDb4v+8

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{9BF634DB-D9C3-4A48-A6CC-4A7AD96BFAF8}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3088	22562822d239afdee4e975bd2ea9864cf21b28c443cda9755ea4b7cc93ec2783.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:964

C:\Users\Admin\AppData\Local\Temp\22562822d239afdee4e975bd2ea9864cf21b28c443cda9755ea4b7cc93ec2783.exe
"C:\Users\Admin\AppData\Local\Temp\22562822d239afdee4e975bd2ea9864cf21b28c443cda9755ea4b7cc93ec2783.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
1KB

MD5
7fbba6bf223d735c8c80fa15dc8e88c2

SHA1
0c46de07de2f2cc6999f73a06c57b671d41f9485

SHA256
0a7734b7cb78771d0245647301e9fa273669d5d1139a06e0696a4be815f58fe3

SHA512
7011d81a182a22e0e9ba4db938063b5012306b001a0f5e4aec8b2490010bd91b59abc14b9958955e17e6c451c90821ac96d109e4f542c2676a4bae7880695c85

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
3KB

MD5
a788fd0ea67f9da1fd6e227b45154409

SHA1
8d90d48d3f6eb5a712becb80abe205197ac51b0d

SHA256
884220d660206d06d1c7253ac7c2b2ffacb2b7a1b7f105a26e67053f406319d0

SHA512
1c59ad4c7dc07ce938d52adc601aa8e13695c2eb6b339a4f56c51a90f8f82c105afc8961328336b0f0b7b6808d0382485bcd4134f412cd2970bafa48cc0f35fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
3KB

MD5
a788fd0ea67f9da1fd6e227b45154409

SHA1
8d90d48d3f6eb5a712becb80abe205197ac51b0d

SHA256
884220d660206d06d1c7253ac7c2b2ffacb2b7a1b7f105a26e67053f406319d0

SHA512
1c59ad4c7dc07ce938d52adc601aa8e13695c2eb6b339a4f56c51a90f8f82c105afc8961328336b0f0b7b6808d0382485bcd4134f412cd2970bafa48cc0f35fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\lite_installer.log

Filesize
4KB

MD5
8d6c8b43465e4afcb16ad1761917b5c6

SHA1
267b7a19e9bc6f205bdaaead4425124b7cdcd797

SHA256
11c5b9d7ed2a3279736b244e4ad5a275909ddc44faee7655e30c51b988bc3405

SHA512
2b12c10df94e4cc18089c076f723404dcd8efe8fed893599fc66f62dbf9feef162f5d766138553d72725a35cbc512c819d96c538d3984bf41e0976ece9f18bd7

Download Submit
C:\Users\Admin\AppData\Roaming\Yandex\ui

Filesize
38B

MD5
b42e92a826b237d4c9d615791b672705

SHA1
e082809652c8d9abe7eb591a86c24ef77e241456

SHA256
25a10e95f63af059136c1e7b6b4ef775662b4c012e92bbf7682754b406b7ab56

SHA512
a4ab255499801f89f6fa3e863d9be9d67fc76b28c46f65cf4704e62d2e1175653e99172a45bb2e720e4f1a11bfa073af90a3d6b4586bc3787aec520b17d300d8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads