Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2023 23:29
Behavioral task
behavioral1
Sample
985aeb70b91dd14a84ba45d51a041a48db6a6af5b3f5bf668bd986f1a67ad07e.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
985aeb70b91dd14a84ba45d51a041a48db6a6af5b3f5bf668bd986f1a67ad07e.dll
Resource
win10v2004-20230831-en
General
-
Target
985aeb70b91dd14a84ba45d51a041a48db6a6af5b3f5bf668bd986f1a67ad07e.dll
-
Size
259KB
-
MD5
850b311135502749b800e16f90b1fb74
-
SHA1
6948966b683f6cc4a1d97c1c5a2c7143550705d1
-
SHA256
985aeb70b91dd14a84ba45d51a041a48db6a6af5b3f5bf668bd986f1a67ad07e
-
SHA512
82630e068fa31d363efdbe129cef894e25696a76634728c280720ce7603c65c21059387e29c5ff40904b4c01d0d1edfdf3417dbc06ef8910fea3bfa5f84234b2
-
SSDEEP
6144:fJqVG5d1IpMyibgkTZI6jHID90awrBXzH/:f3d6tevoxArBXD
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{04DE4B37-5102-40DD-9963-DEE670C2373D}.catalogItem svchost.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4712 3032 WerFault.exe rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\985aeb70b91dd14a84ba45d51a041a48db6a6af5b3f5bf668bd986f1a67ad07e.dll,#11⤵PID:3032
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3032 -s 3282⤵
- Program crash
PID:4712
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2616
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 3032 -ip 30321⤵PID:3696