Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-05-2022 01:40
Static task
static1
Behavioral task
behavioral1
Sample
2d123daaed835ad3ccfe84a2fd14840a8f3665ab62108aa9c21f4f9e9e6b2d92.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2d123daaed835ad3ccfe84a2fd14840a8f3665ab62108aa9c21f4f9e9e6b2d92.exe
Resource
win10v2004-20220414-en
General
-
Target
2d123daaed835ad3ccfe84a2fd14840a8f3665ab62108aa9c21f4f9e9e6b2d92.exe
-
Size
378KB
-
MD5
8c5624b50939d46b9eee1627269ca01d
-
SHA1
4ad3050c7650409d814e9c249891f7d7e8cf7b63
-
SHA256
2d123daaed835ad3ccfe84a2fd14840a8f3665ab62108aa9c21f4f9e9e6b2d92
-
SHA512
199679b106053ef75f38715ad21ab2e6c144ab3c9a57c04761c107ca640ae466bd9d6d6cdd019750d4fe4aeb18b212beab8815044e6e1abe6ca6df436e18a46f
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2d123daaed835ad3ccfe84a2fd14840a8f3665ab62108aa9c21f4f9e9e6b2d92.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 2d123daaed835ad3ccfe84a2fd14840a8f3665ab62108aa9c21f4f9e9e6b2d92.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2d123daaed835ad3ccfe84a2fd14840a8f3665ab62108aa9c21f4f9e9e6b2d92.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2d123daaed835ad3ccfe84a2fd14840a8f3665ab62108aa9c21f4f9e9e6b2d92.exedescription pid process Token: SeDebugPrivilege 1176 2d123daaed835ad3ccfe84a2fd14840a8f3665ab62108aa9c21f4f9e9e6b2d92.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d123daaed835ad3ccfe84a2fd14840a8f3665ab62108aa9c21f4f9e9e6b2d92.exe"C:\Users\Admin\AppData\Local\Temp\2d123daaed835ad3ccfe84a2fd14840a8f3665ab62108aa9c21f4f9e9e6b2d92.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1176-130-0x00007FF9698E0000-0x00007FF96A316000-memory.dmpFilesize
10.2MB