Analysis
-
max time kernel
71s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
10-06-2022 15:37
Static task
static1
Behavioral task
behavioral1
Sample
5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54.exe
Resource
win10v2004-20220414-en
General
-
Target
5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54.exe
-
Size
47KB
-
MD5
0d225faf96ee8d83cb69fbfcceba98bc
-
SHA1
a7b3c081b405cccfd55b8e64a6922fbc69bd733c
-
SHA256
5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54
-
SHA512
dbc0501e031e711a756519dd4dbe83fc18ecc2f25fed205ef5d9fdc7b9e54e5dd6995250bcfa494e26e8f12a497842987af490f82d787033931306aec07edfd9
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dw20.exedescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
dw20.exedescription pid Process Token: SeBackupPrivilege 4620 dw20.exe Token: SeBackupPrivilege 4620 dw20.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54.exedescription pid Process procid_target PID 5076 wrote to memory of 4620 5076 5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54.exe 86 PID 5076 wrote to memory of 4620 5076 5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54.exe"C:\Users\Admin\AppData\Local\Temp\5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 18282⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4620
-