Analysis
-
max time kernel
97s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:46
Static task
static1
Behavioral task
behavioral1
Sample
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe
Resource
win10v2004-20220414-en
General
-
Target
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe
-
Size
2.8MB
-
MD5
7c59b7e996ff2c53ff916e7ae9208618
-
SHA1
8dd9b9b17ec3759c430346bfc961d79d1e32b2a2
-
SHA256
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d
-
SHA512
3d3d8d8d9edf5f08c6ab041677f47b7ee8fb04f3f819bd3872f522bb713440e173354d9e16a780bd0d4867cb78edfaab47da73423338a547e1ff36724c3f94a0
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exedescription ioc process File opened for modification \??\PhysicalDrive0 ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3736 2156 WerFault.exe ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Bios ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exepid process 2156 ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exedescription pid process Token: SeIncBasePriorityPrivilege 2156 ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe"C:\Users\Admin\AppData\Local\Temp\ea80a4e9ff8cbac61bab3c8b1ec23c2e0ef8408439446de1efff04f4e3fee55d.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 8682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2156 -ip 21561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2156-130-0x0000000000400000-0x00000000008D6000-memory.dmpFilesize
4.8MB
-
memory/2156-131-0x0000000000400000-0x00000000008D6000-memory.dmpFilesize
4.8MB
-
memory/2156-132-0x0000000000400000-0x00000000008D6000-memory.dmpFilesize
4.8MB
-
memory/2156-133-0x00000000058F0000-0x0000000007791000-memory.dmpFilesize
30.6MB
-
memory/2156-134-0x0000000000400000-0x00000000008D6000-memory.dmpFilesize
4.8MB