737c280d389af8a0f40aba4b9bb311e9eaa4657be796a05a969aef9b33446806

Analysis

max time kernel
135s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

737c280d389af8a0f40aba4b9bb311e9eaa4657be796a05a969aef9b33446806.exe
Size

108KB
MD5

922469a7cf5f2958a93c34a114167098
SHA1

db278a152ce0589801c5c79b57bbf00d4caa24e5
SHA256

737c280d389af8a0f40aba4b9bb311e9eaa4657be796a05a969aef9b33446806
SHA512

3ce42400d7d808d36df79220d0852576d92cc198d05ef03b47e49074296697a5b8b46226fe32feadc1fee300ce849bda102f7d606cb32539ded9dcfeec484df5
SSDEEP

1536:A65+LXnUBnyhBP0DULZaNPktpey/V+Noov8Sz6P1PWLtW/U:A65+LkuvLIBktpey/vof2P1OtWM

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
624	1111111
1344	1111111

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1111111
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	1111111

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 624	4880	737c280d389af8a0f40aba4b9bb311e9eaa4657be796a05a969aef9b33446806.exe	82
PID 4880 wrote to memory of 624	4880	737c280d389af8a0f40aba4b9bb311e9eaa4657be796a05a969aef9b33446806.exe	82
PID 4880 wrote to memory of 624	4880	737c280d389af8a0f40aba4b9bb311e9eaa4657be796a05a969aef9b33446806.exe	82

C:\Users\Admin\AppData\Local\Temp\737c280d389af8a0f40aba4b9bb311e9eaa4657be796a05a969aef9b33446806.exe
"C:\Users\Admin\AppData\Local\Temp\737c280d389af8a0f40aba4b9bb311e9eaa4657be796a05a969aef9b33446806.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Documents and Settings\1111111
  "C:\Documents and Settings\1111111"
  2⤵
  - Executes dropped EXE
  PID:624

C:\Documents and Settings\1111111
"C:\Documents and Settings\1111111"
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\1111111

Filesize
108KB

MD5
922469a7cf5f2958a93c34a114167098

SHA1
db278a152ce0589801c5c79b57bbf00d4caa24e5

SHA256
737c280d389af8a0f40aba4b9bb311e9eaa4657be796a05a969aef9b33446806

SHA512
3ce42400d7d808d36df79220d0852576d92cc198d05ef03b47e49074296697a5b8b46226fe32feadc1fee300ce849bda102f7d606cb32539ded9dcfeec484df5

Download Submit
C:\Users\1111111

Filesize
108KB

MD5
922469a7cf5f2958a93c34a114167098

SHA1
db278a152ce0589801c5c79b57bbf00d4caa24e5

SHA256
737c280d389af8a0f40aba4b9bb311e9eaa4657be796a05a969aef9b33446806

SHA512
3ce42400d7d808d36df79220d0852576d92cc198d05ef03b47e49074296697a5b8b46226fe32feadc1fee300ce849bda102f7d606cb32539ded9dcfeec484df5

Download Submit
C:\Users\1111111

Filesize
108KB

MD5
922469a7cf5f2958a93c34a114167098

SHA1
db278a152ce0589801c5c79b57bbf00d4caa24e5

SHA256
737c280d389af8a0f40aba4b9bb311e9eaa4657be796a05a969aef9b33446806

SHA512
3ce42400d7d808d36df79220d0852576d92cc198d05ef03b47e49074296697a5b8b46226fe32feadc1fee300ce849bda102f7d606cb32539ded9dcfeec484df5

Download Submit