5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f

Analysis

max time kernel
113s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe
Size

515KB
MD5

6034d6d866752d018d5ffa483c66de50
SHA1

bbb8f4555ec9185877cee4e19758d38e45a0b47c
SHA256

5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f
SHA512

572d472249dc4f92fbb4f447c13c8aea5c3bd6197d2e8a99c2586c67645436a890b991e451622ea75076ea91f6173de7f3264186b90d63db419147385efa3e73
SSDEEP

12288:lF+36OGJ8833aTvT/wNcezucVPfHhiSZP62xdEMjtP:lJi83qbTUceK+xLRxdEMt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4588	4972	WerFault.exe	81

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4972	5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe
4972	5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4972	5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4972	5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe

C:\Users\Admin\AppData\Local\Temp\5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe
"C:\Users\Admin\AppData\Local\Temp\5b6b77b610c1bb2c499e9f8ac426bbc5091a7eab5b7687ba043d488f1d3d7f0f.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 472
  2⤵
  - Program crash
  PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4972 -ip 4972
1⤵
PID:3232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads