5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f

Analysis

max time kernel
131s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe
Size

515KB
MD5

6034d6d866752d018d5ffa483c66de50
SHA1

bbb8f4555ec9185877cee4e19758d38e45a0b47c
SHA256

5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f
SHA512

572d472249dc4f92fbb4f447c13c8aea5c3bd6197d2e8a99c2586c67645436a890b991e451622ea75076ea91f6173de7f3264186b90d63db419147385efa3e73
SSDEEP

12288:lF+36OGJ8833aTvT/wNcezucVPfHhiSZP62xdEMjtP:lJi83qbTUceK+xLRxdEMt

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
364	5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
364	5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe

C:\Users\Admin\AppData\Local\Temp\5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe
"C:\Users\Admin\AppData\Local\Temp\5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:364

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download