c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/10/2022, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
Size

5.7MB
MD5

150c514af94c62f7ce0c72b942ceecda
SHA1

0e4af543b781456af185a6491b00c961926fb988
SHA256

c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc
SHA512

b0f9c0b2c3b8deca96bdd922da4519cb4352c3ff430b008df53a0001e721b691c9e5b5577c21728da8e97534a2dcddfa4a692e85882e5940365f1cc233872e70
SSDEEP

98304:ysFpQFP3a3evuuy1sFi1gsRRM/cQjaQGbc+tPet+g1Bew79roK:ysEo3uyL1l7Mclfbc+tPet+g14w7B

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\G:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\H:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\J:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\N:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\Q:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\U:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\Y:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\F:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\R:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\S:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\T:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\V:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\W:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\X:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\K:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\M:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\E:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\I:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\L:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\O:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
File opened (read-only)	\??\P:	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4724	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBIOSDate	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4724	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
4724	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
4724	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
4724	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4724	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
4724	c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe

C:\Users\Admin\AppData\Local\Temp\c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe
"C:\Users\Admin\AppData\Local\Temp\c864f769a146493f00dd2b33cfa4159abe7e0b34613b4b4256cf46f606d719dc.exe"
1⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4724-132-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download
memory/4724-133-0x0000000000400000-0x00000000006F4000-memory.dmp

Filesize
3.0MB

Download