Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2023 21:23
Behavioral task
behavioral1
Sample
2148-0-0x0000000000400000-0x000000000043D000-memory.exe
Resource
win7-20230831-en
General
-
Target
2148-0-0x0000000000400000-0x000000000043D000-memory.exe
-
Size
244KB
-
MD5
dd9535a504ca6efc32f0dd698a9c6477
-
SHA1
67d3f6006c4aee916e09f865d8b49ec3eccb116a
-
SHA256
44d14eff8d2c2465b46a84d442c0f6eb8257865a35ca254cb5ddaffbb26867d9
-
SHA512
205427cadfd164d9b1ce294c8d842a276a64cef78ecced3f577a99721a01e0387663db607d1b32dd6bcdeec941ed8b442f9afefc7c766dbe31d8c4cb26253758
-
SSDEEP
1536:UYz/E8hW9NdYAygNlvhIoOl9SAKD7PNch1ZmmImh1ADN8blGe5SagvHLNaV8CJ3n:Um/E8k9ZjpIL+zNch12KbAwSaS6JSp8
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{361652CA-31DF-4E5E-B115-404B62618D44}.catalogItem svchost.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3768 2016 WerFault.exe 2148-0-0x0000000000400000-0x000000000043D000-memory.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2148-0-0x0000000000400000-0x000000000043D000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2148-0-0x0000000000400000-0x000000000043D000-memory.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 2162⤵
- Program crash
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2016 -ip 20161⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2016-0-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB