e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866

General

Target

e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe
Size

1.5MB
MD5

14b767301d26dd2dc9d507b8aeaa4841
SHA1

32054ef0212186497a6fe936faeb992b03446a48
SHA256

e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866
SHA512

3a6f84eddae25fd82dd7cd1f905fbd5a73f70e40f1c0127a67e723b48167b17cf1618996b2c63f81bfe5ac2ad494d634b2dada1ea1c58f4823ea44a87131371d
SSDEEP

24576:DUFHwm4CtRmio7XmKFID/kZECDx00Nltv/LQ57bJs8yqJsJk:DcwMmiwmQITiECLtvDQBbCqJA

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
3920	svchost.exe
3192	svchost.exe
4320	svchost.exe
2572	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
4736	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3836	3192	WerFault.exe	97

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000_Classes\Local Settings	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3920	svchost.exe
3920	svchost.exe
3192	svchost.exe
3192	svchost.exe
3920	svchost.exe
3920	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
676	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	svchost.exe
Token: SeDebugPrivilege	3192	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4736	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe
4736	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe
4736	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 3920	4736	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe	87
PID 4736 wrote to memory of 3920	4736	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe	87
PID 4736 wrote to memory of 3920	4736	e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe	87
PID 3192 wrote to memory of 4320	3192	svchost.exe	98
PID 3192 wrote to memory of 4320	3192	svchost.exe	98
PID 3192 wrote to memory of 4320	3192	svchost.exe	98
PID 3192 wrote to memory of 2572	3192	svchost.exe	99
PID 3192 wrote to memory of 2572	3192	svchost.exe	99
PID 3192 wrote to memory of 2572	3192	svchost.exe	99
PID 3920 wrote to memory of 1608	3920	svchost.exe	103
PID 3920 wrote to memory of 1608	3920	svchost.exe	103
PID 3920 wrote to memory of 1608	3920	svchost.exe	103

C:\Users\Admin\AppData\Local\Temp\e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe
"C:\Users\Admin\AppData\Local\Temp\e0556c1454a4ab35dcd016945376fc43f8fc1555ef99985014c38c7ac9247866.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\434.vbs"
    3⤵
    PID:1608

C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe
"C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe
  "C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe" Win7
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Checks processor information in registry
  PID:4320
- C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe
  "C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe" Win7
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 392
  2⤵
  - Program crash
  PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3192 -ip 3192
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\434.vbs

Filesize
500B

MD5
50a08ac434f85249aeb4480f11d0b174

SHA1
3785e37a0702a74bd9752169c0395807a744a1b5

SHA256
7cb5b0b029f00d79c0262941520b54391f838f91fdba887d220e984f0572b382

SHA512
c42bf506e43c57961d2962a2d7ecf14a713a685d806086d8e4c9764eadb18ab12749eb19621b389a17bee6acd22ad4f6ab3ad4efa1d511e241512fafd5af4049

Download Submit
C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
C:\Program Files (x86)\Microsoft Oeuqie\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x64dd.DLL

Filesize
832KB

MD5
46eb6c37460b1a9115edd9d6b1c279a6

SHA1
6c43291fdb934f9e9424c8ecde8d1a554ee3735b

SHA256
17ef93e0f8f09b9b97ceb9deaac145011669e64f768e184e17db345a128895d7

SHA512
a381f26deed1e5aa2217939fc37f3467bd4eb850310973978cf8d5d23cf41071856ef98fcc12b9541a521b1ed1266cc1516bacbf61c164a752b993a8024ad18b

Download Submit
C:\Windows\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit
C:\Windows\svchost.exe

Filesize
68KB

MD5
5395328696453d78c565bfd81e8d3f99

SHA1
3c1c265e277d47af7ad7ace0ba45d682bd0f24e3

SHA256
b005ced9ff2c6c997a693064132b6567282c9dc440968020a880a4a193fc5b92

SHA512
69c02ac7cfb7e4f27436aeba637e78b1be58d1bf2a1d3643afb8c443a348c444dd6f0e44ea6a2c795eae21e93315a34f6cd07f986fc57b2e2289d917076a825e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads