b90fe38b8108baa546e7827b6e647c3b5b7be2d4c7d7147d2eb68f3676614320

Analysis

max time kernel
86s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b90fe38b8108baa546e7827b6e647c3b5b7be2d4c7d7147d2eb68f3676614320.exe
Size

1.1MB
MD5

40b9273eb843cd1875593341bd0e2477
SHA1

35cc7ae1461ec3332fd077abff5b0d0dcb4ba156
SHA256

b90fe38b8108baa546e7827b6e647c3b5b7be2d4c7d7147d2eb68f3676614320
SHA512

af15267d87e6b788bceb2ecaeebf366127161986e37f0df808677952431ba76e90309b61d4d3e5c772124c9af3c4449ed1158762f3aa043523ef43a6cec1968c
SSDEEP

24576:cCSNo49qpg2BEd4Hc8p3mNiia/ERIs+nt+NE:PWbChHNOi/sHA+NE

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b90fe38b8108baa546e7827b6e647c3b5b7be2d4c7d7147d2eb68f3676614320.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5016	b90fe38b8108baa546e7827b6e647c3b5b7be2d4c7d7147d2eb68f3676614320.exe
5016	b90fe38b8108baa546e7827b6e647c3b5b7be2d4c7d7147d2eb68f3676614320.exe
5016	b90fe38b8108baa546e7827b6e647c3b5b7be2d4c7d7147d2eb68f3676614320.exe
5016	b90fe38b8108baa546e7827b6e647c3b5b7be2d4c7d7147d2eb68f3676614320.exe

C:\Users\Admin\AppData\Local\Temp\b90fe38b8108baa546e7827b6e647c3b5b7be2d4c7d7147d2eb68f3676614320.exe
"C:\Users\Admin\AppData\Local\Temp\b90fe38b8108baa546e7827b6e647c3b5b7be2d4c7d7147d2eb68f3676614320.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of SetWindowsHookEx
PID:5016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5016-132-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/5016-133-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/5016-134-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/5016-135-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/5016-136-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/5016-138-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/5016-139-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/5016-140-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/5016-141-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download