71bc38f1873dde28c4a2a7605527adc649ffa6510b907b2698990fd5ee49f5c8

Analysis

max time kernel
6s
max time network
15s
platform
windows7_x64
resource
win7v20210408
submitted
20-07-2021 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3577889cdae96c45ac86d0fabe6723b0.exe
Size

636KB
MD5

3577889cdae96c45ac86d0fabe6723b0
SHA1

814ba96911f17ded4808b2776ebb43db3d3d2656
SHA256

71bc38f1873dde28c4a2a7605527adc649ffa6510b907b2698990fd5ee49f5c8
SHA512

bd7490bf182762ba0acee9f49e486c94c4b9c67e029f47b0782b9223f0a88d497e24a9f54b220e7f095a1f2f6149d6981e816adeacf9e7971b6e3ed7c48e866d

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3577889cdae96c45ac86d0fabe6723b0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	3577889cdae96c45ac86d0fabe6723b0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	3577889cdae96c45ac86d0fabe6723b0.exe

C:\Users\Admin\AppData\Local\Temp\3577889cdae96c45ac86d0fabe6723b0.exe
"C:\Users\Admin\AppData\Local\Temp\3577889cdae96c45ac86d0fabe6723b0.exe"
1⤵
- Checks processor information in registry
PID:1996

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-59-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1996-60-0x0000000000910000-0x00000000009E1000-memory.dmp

Filesize
836KB

Download
memory/1996-61-0x0000000000400000-0x0000000000908000-memory.dmp

Filesize
5.0MB

Download