8397cffc2c431386aaa2e67f43f15b5e6317e135964b01e91b11a5e2b7c29271

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8397cffc2c431386aaa2e67f43f15b5e6317e135964b01e91b11a5e2b7c29271.exe
Size

109KB
MD5

6b3b439329da3ab42bdb09887625db04
SHA1

1d4153bef43699b163fdc333e6c3c63a522ea763
SHA256

8397cffc2c431386aaa2e67f43f15b5e6317e135964b01e91b11a5e2b7c29271
SHA512

7d2105f650eb7c65fb0538fa88ec6d3f74f4f246fde43be576e42cc9f42abfd4e1c4e201cc3d434f0928d450e293640beca70e8ce9c3fa6c095604f3985edac7
SSDEEP

3072:U49xGRIHOlD+vRAw0R5mb5u5c+uuvRzsX+gukXM+:FxGRIupE0eb5a9uuZ2zc+

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8397cffc2c431386aaa2e67f43f15b5e6317e135964b01e91b11a5e2b7c29271.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	8397cffc2c431386aaa2e67f43f15b5e6317e135964b01e91b11a5e2b7c29271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	8397cffc2c431386aaa2e67f43f15b5e6317e135964b01e91b11a5e2b7c29271.exe

C:\Users\Admin\AppData\Local\Temp\8397cffc2c431386aaa2e67f43f15b5e6317e135964b01e91b11a5e2b7c29271.exe
"C:\Users\Admin\AppData\Local\Temp\8397cffc2c431386aaa2e67f43f15b5e6317e135964b01e91b11a5e2b7c29271.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
PID:1448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads