929adcf731e730ee1251eeef8513fd774b1357c1c3e1da4d287722ed778434f9

Analysis

max time kernel
62s
max time network
104s
platform
windows7_x64
resource
win7-en-20211014
submitted
20-10-2021 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Size

5.4MB
MD5

27c2ecaf69cd729d338c091d24864c49
SHA1

b175b803f451776a07932e40f7831cf8030699d1
SHA256

11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67
SHA512

9f90219012c11149ce0c03409db8b25d679daba9dca9c44e27ea22282e036b00272497fb718ba22e2f93d3c268824596bffda09c6b47da6b35f9cf01c7509f21

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe

Modifies registry class 13 IoCs

Processes:

11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\ = "PhotoProgressDialog"	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\InprocServer32	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\InprocServer32\ = "%ProgramFiles(x86)%\\Windows Photo Viewer\\PhotoAcq.dll"	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\InprocServer32\ThreadingModel = "Apartment"	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\ProgID	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\ProgID\ = "Microsoft.PhotoProgressDialog.1"	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\TypeLib	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\TypeLib\ = "{00f25ae8-3625-4e34-92d4-f0918cf010ee}"	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\Version	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\Version\ = "1.0"	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\VersionIndependentProgID\ = "Microsoft.PhotoProgressDialog"	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D4EF29E-E31A-655C-FE52-D8BA485F1500}\VersionIndependentProgID	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe

description	pid	process
Token: 33	1156	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Token: SeIncBasePriorityPrivilege	1156	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
Token: SeDebugPrivilege	1156	11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe

C:\Users\Admin\AppData\Local\Temp\11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe
"C:\Users\Admin\AppData\Local\Temp\11747d3247254b7db3fb7d6b8c0b47d21546b208b1573a73ae20f46ca4131e67.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/1156-56-0x0000000002DE0000-0x0000000002ED9000-memory.dmp

Filesize
996KB

Download
memory/1156-60-0x0000000000400000-0x000000000138E000-memory.dmp

Filesize
15.6MB

Download
memory/1156-61-0x0000000000400000-0x000000000138E000-memory.dmp

Filesize
15.6MB

Download
memory/1156-62-0x0000000000400000-0x000000000138E000-memory.dmp

Filesize
15.6MB

Download
memory/1156-63-0x0000000002F10000-0x0000000002F30000-memory.dmp

Filesize
128KB

Download
memory/1156-64-0x0000000000470000-0x000000000048FFE2-memory.dmp

Filesize
127KB

Download
memory/1156-65-0x00000000002E1000-0x00000000002EA000-memory.dmp

Filesize
36KB

Download
memory/1156-66-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download