ff48823bab26af1bc296df201ea2ca388c9d9938b029afa59dc213365fc76aa2

Analysis

max time kernel
157s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff48823bab26af1bc296df201ea2ca388c9d9938b029afa59dc213365fc76aa2.exe
Size

107KB
MD5

74cde173224659d2b0556650825a59c0
SHA1

e5c2a43daec1ae53937e7ef86c530d52899ac703
SHA256

ff48823bab26af1bc296df201ea2ca388c9d9938b029afa59dc213365fc76aa2
SHA512

71788601028cac0f52af0b26571e78b7db9809ece5fdf8426df57576dc7c98d283f9e0e8691c043def810e50b463bcf1336863a8fc82a0ddd74bef4bcd3e1b8a
SSDEEP

1536:NSjRtTkrNCgr0Zk0vShzYW+lt6tyHaOq9wmskMMMlZ8VGVe7ws/Y8WGK:NYRkrHgZd6YTltqyHaOq6VqVMe7ws/YJ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4376	vabdau.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vabdau.exe	ff48823bab26af1bc296df201ea2ca388c9d9938b029afa59dc213365fc76aa2.exe
File opened for modification	C:\Windows\SysWOW64\vabdau.exe	ff48823bab26af1bc296df201ea2ca388c9d9938b029afa59dc213365fc76aa2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vabdau.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vabdau.exe

C:\Users\Admin\AppData\Local\Temp\ff48823bab26af1bc296df201ea2ca388c9d9938b029afa59dc213365fc76aa2.exe
"C:\Users\Admin\AppData\Local\Temp\ff48823bab26af1bc296df201ea2ca388c9d9938b029afa59dc213365fc76aa2.exe"
1⤵
- Drops file in System32 directory
PID:1972

C:\Windows\SysWOW64\vabdau.exe
C:\Windows\SysWOW64\vabdau.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\vabdau.exe

Filesize
107KB

MD5
74cde173224659d2b0556650825a59c0

SHA1
e5c2a43daec1ae53937e7ef86c530d52899ac703

SHA256
ff48823bab26af1bc296df201ea2ca388c9d9938b029afa59dc213365fc76aa2

SHA512
71788601028cac0f52af0b26571e78b7db9809ece5fdf8426df57576dc7c98d283f9e0e8691c043def810e50b463bcf1336863a8fc82a0ddd74bef4bcd3e1b8a

Download Submit
C:\Windows\SysWOW64\vabdau.exe

Filesize
107KB

MD5
74cde173224659d2b0556650825a59c0

SHA1
e5c2a43daec1ae53937e7ef86c530d52899ac703

SHA256
ff48823bab26af1bc296df201ea2ca388c9d9938b029afa59dc213365fc76aa2

SHA512
71788601028cac0f52af0b26571e78b7db9809ece5fdf8426df57576dc7c98d283f9e0e8691c043def810e50b463bcf1336863a8fc82a0ddd74bef4bcd3e1b8a

Download Submit