d8681cb9b7eeaf66c5057dea4102bda732fa887debb8495d0784a7921f59c6b5

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5b2fcb7b669dae8dfc3ac761f3e5b669.exe
Size

420KB
MD5

5b2fcb7b669dae8dfc3ac761f3e5b669
SHA1

107897a22cd8c6ba2b33321b2282748cba66688b
SHA256

d8681cb9b7eeaf66c5057dea4102bda732fa887debb8495d0784a7921f59c6b5
SHA512

8db3486a94eb495c0b14fc3f19383bca85600944db524bb194536cb2a17dfb0b9b837b7e1475f3c0b2d0627b35758d22b3a6c209eae27214e2b18d8ef8e2a6e6
SSDEEP

12288:sXukg+ih8FfXhre/8J8BvRYDlhaEbAAOw+:5h8FfXhqg8B2xsl1

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2684	SVCH0ST.EXE

Loads dropped DLL 2 IoCs

pid	Process
2684	SVCH0ST.EXE
2684	SVCH0ST.EXE

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\KeySpy.dll	SVCH0ST.EXE
File opened for modification	C:\Windows\SysWOW64\KeySpy.dll	SVCH0ST.EXE

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SVCH0ST.cfg	SVCH0ST.EXE
File created	C:\Windows\SVCH0ST.cfg	SVCH0ST.EXE
File created	C:\Windows\SVCH0ST.EXE	5b2fcb7b669dae8dfc3ac761f3e5b669.exe
File opened for modification	C:\Windows\SVCH0ST.EXE	5b2fcb7b669dae8dfc3ac761f3e5b669.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International	5b2fcb7b669dae8dfc3ac761f3e5b669.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\sDate = "-"	5b2fcb7b669dae8dfc3ac761f3e5b669.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\sDate = "-"	SVCH0ST.EXE
Key created	\REGISTRY\USER\.Default\Software\Microsoft\Windows\CurrentVersion\Internet Settings	5b2fcb7b669dae8dfc3ac761f3e5b669.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial = 00000000	5b2fcb7b669dae8dfc3ac761f3e5b669.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodisconnect = 00000000	5b2fcb7b669dae8dfc3ac761f3e5b669.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International	SVCH0ST.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	SVCH0ST.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	5b2fcb7b669dae8dfc3ac761f3e5b669.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	5b2fcb7b669dae8dfc3ac761f3e5b669.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	5b2fcb7b669dae8dfc3ac761f3e5b669.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	SVCH0ST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	SVCH0ST.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2684	SVCH0ST.EXE
2684	SVCH0ST.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2684	SVCH0ST.EXE
2684	SVCH0ST.EXE

C:\Users\Admin\AppData\Local\Temp\5b2fcb7b669dae8dfc3ac761f3e5b669.exe
"C:\Users\Admin\AppData\Local\Temp\5b2fcb7b669dae8dfc3ac761f3e5b669.exe"
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4756

C:\Windows\SVCH0ST.EXE
C:\Windows\SVCH0ST.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SVCH0ST.EXE

Filesize
95KB

MD5
8f45af7899a9694ebe43834182c31a79

SHA1
291a25a31d1db20eabba93b4870fa2ae984f6899

SHA256
8da37177a58e523cd5eb8de82ca3394251e8e3692bd8df2cfddca5d050f3d2d9

SHA512
7942aa78593492f868b6e09debc01ec0ec634c14b1a52f05e703f563f8fa5cb13fbd224747223d9e49771049f62f8a723b69dbce7250d52adfa1fcc1be0c08c0

Download Submit
memory/2684-70-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/2684-69-0x00000000011B0000-0x00000000011B1000-memory.dmp

Filesize
4KB

Download
memory/2684-68-0x00000000011C0000-0x00000000011C1000-memory.dmp

Filesize
4KB

Download
memory/2684-67-0x0000000001190000-0x0000000001191000-memory.dmp

Filesize
4KB

Download
memory/2684-66-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/2684-65-0x0000000001170000-0x0000000001171000-memory.dmp

Filesize
4KB

Download
memory/2684-64-0x0000000001180000-0x0000000001181000-memory.dmp

Filesize
4KB

Download
memory/2684-63-0x0000000001160000-0x0000000001161000-memory.dmp

Filesize
4KB

Download
memory/2684-62-0x0000000001130000-0x0000000001131000-memory.dmp

Filesize
4KB

Download
memory/2684-61-0x0000000001140000-0x0000000001141000-memory.dmp

Filesize
4KB

Download
memory/2684-60-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/2684-59-0x0000000001120000-0x0000000001121000-memory.dmp

Filesize
4KB

Download
memory/2684-58-0x00000000010F0000-0x00000000010F1000-memory.dmp

Filesize
4KB

Download
memory/2684-57-0x0000000001100000-0x0000000001101000-memory.dmp

Filesize
4KB

Download
memory/2684-56-0x00000000010D0000-0x00000000010D1000-memory.dmp

Filesize
4KB

Download
memory/2684-55-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/2684-54-0x00000000010B0000-0x00000000010B1000-memory.dmp

Filesize
4KB

Download
memory/2684-53-0x00000000010C0000-0x00000000010C1000-memory.dmp

Filesize
4KB

Download
memory/2684-52-0x0000000001090000-0x0000000001091000-memory.dmp

Filesize
4KB

Download
memory/2684-51-0x00000000010A0000-0x00000000010A1000-memory.dmp

Filesize
4KB

Download
memory/2684-50-0x0000000000F20000-0x0000000000F21000-memory.dmp

Filesize
4KB

Download
memory/2684-49-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download
memory/2684-48-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/2684-47-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2684-46-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2684-45-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/2684-138-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2684-130-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4756-40-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4756-20-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/4756-41-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/4756-43-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download
memory/4756-42-0x0000000000AB0000-0x0000000000AE0000-memory.dmp

Filesize
192KB

Download
memory/4756-39-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/4756-38-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download
memory/4756-37-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/4756-36-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/4756-34-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/4756-31-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/4756-30-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/4756-29-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/4756-27-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/4756-26-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/4756-24-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/4756-23-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/4756-22-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/4756-21-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/4756-44-0x00000000024C0000-0x00000000024C4000-memory.dmp

Filesize
16KB

Download
memory/4756-19-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/4756-18-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4756-17-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/4756-16-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/4756-15-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/4756-12-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/4756-11-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/4756-10-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/4756-9-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/4756-8-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4756-7-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/4756-6-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/4756-5-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/4756-4-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/4756-3-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/4756-2-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4756-1-0x0000000000AB0000-0x0000000000AE0000-memory.dmp

Filesize
192KB

Download
memory/4756-35-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/4756-0-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download