Analysis
-
max time kernel
45s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 04:46
Static task
static1
Behavioral task
behavioral1
Sample
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe
Resource
win10v2004-20220414-en
General
-
Target
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe
-
Size
2.8MB
-
MD5
7c59b7e996ff2c53ff916e7ae9208618
-
SHA1
8dd9b9b17ec3759c430346bfc961d79d1e32b2a2
-
SHA256
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d
-
SHA512
3d3d8d8d9edf5f08c6ab041677f47b7ee8fb04f3f819bd3872f522bb713440e173354d9e16a780bd0d4867cb78edfaab47da73423338a547e1ff36724c3f94a0
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exedescription ioc process File opened for modification \??\PhysicalDrive0 ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Bios ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exepid process 1648 ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exedescription pid process Token: SeIncBasePriorityPrivilege 1648 ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe"C:\Users\Admin\AppData\Local\Temp\ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken