929adcf731e730ee1251eeef8513fd774b1357c1c3e1da4d287722ed778434f9

Analysis

Target

CW3.exe
Size

15.4MB
MD5

c67252dc22f8b34524d9fcc1256d738d
SHA1

56917892ceae7df9056f12b419aa8c5eec3f1bae
SHA256

e738a7ee12e2eafb48366e84f8cd089c4433d2a2223954f3642a1c71ce80e456
SHA512

351877cc61e747b8b6c24e72a2d183024d6b2e3333be5c47f2efa3941cc2298f972e92d7367226cdf0841fec4ca53fdde3a067ae75b4f5521ef9c5d4feded672

Score

1^/10

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

CW3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CW3.exe
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CW3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CW3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

CW3.exe

pid process

2136 CW3.exe

pid	process
2136	CW3.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/2136-116-0x0000000004F90000-0x0000000005090000-memory.dmp

Filesize
1024KB

Download
memory/2136-115-0x00000000049A0000-0x0000000004AA0000-memory.dmp

Filesize
1024KB

Download