2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8.exe
Size

121KB
MD5

58a4c58cde4ea51714329309fdc4aa50
SHA1

d3c29cf61d64f772eca7f5c39ba3c54c3703d9af
SHA256

2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8
SHA512

48782e001a2bc5f5b0b60dacd5250556f5e2791faa08f179f071c471718f5a36293702b02ae15dea04e1b0b4e5297d8dea6379747e36ad3a2760fde7e60d7025
SSDEEP

3072:Lxe4RBDT+JLEtrw/pwPkYbcAVfpgd58P9z3:Lk4RBDT+JLE8pwgAxpgsZ3

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4844	2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4844	2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8.exe

C:\Users\Admin\AppData\Local\Temp\2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8.exe
"C:\Users\Admin\AppData\Local\Temp\2b5ba7f691b318b4754ddb1f5aca76141daf6d7e4a0d364fd9d625dd2e2046f8.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads