d8acc172e601892179473d660dc51ecad3494865e8c61f008f42eeaa84e1295c

Analysis

max time kernel
34s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 21:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d8acc172e601892179473d660dc51ecad3494865e8c61f008f42eeaa84e1295c.exe
Size

4.6MB
MD5

af726f35e68e5731743f4816a0b0db1f
SHA1

9abe3f44bdf7fd6e9b3a0e31a3cd4f5edefe8d9f
SHA256

d8acc172e601892179473d660dc51ecad3494865e8c61f008f42eeaa84e1295c
SHA512

787bfd209318ded9a75f0750a1f55a34f7046113e6218096bd7aa5ab160f1899bcafbe71fc91685d9dfbc2df3ae018bc2ac0f703f031e54741e1d48e7023844a
SSDEEP

98304:AMrvAaU/7oEb0SIkniBh3kfkeXMfC4lKvdHtbdG3dLMB19qnlARZjH:JoaU/MOCBh6VXN4Mvd5INLMEnaH

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2732	d8acc172e601892179473d660dc51ecad3494865e8c61f008f42eeaa84e1295c.exe
2732	d8acc172e601892179473d660dc51ecad3494865e8c61f008f42eeaa84e1295c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3228	2732	WerFault.exe	75

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	d8acc172e601892179473d660dc51ecad3494865e8c61f008f42eeaa84e1295c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	d8acc172e601892179473d660dc51ecad3494865e8c61f008f42eeaa84e1295c.exe

C:\Users\Admin\AppData\Local\Temp\d8acc172e601892179473d660dc51ecad3494865e8c61f008f42eeaa84e1295c.exe
"C:\Users\Admin\AppData\Local\Temp\d8acc172e601892179473d660dc51ecad3494865e8c61f008f42eeaa84e1295c.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
PID:2732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2732 -s 272
  2⤵
  - Program crash
  PID:3228

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 2732 -ip 2732
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-132-0x0000000140000000-0x0000000140A82000-memory.dmp

Filesize
10.5MB

Download
memory/2732-133-0x0000000140000000-0x0000000140A82000-memory.dmp

Filesize
10.5MB

Download
memory/2732-134-0x0000000140000000-0x0000000140A82000-memory.dmp

Filesize
10.5MB

Download
memory/2732-135-0x0000000140000000-0x0000000140A82000-memory.dmp

Filesize
10.5MB

Download
memory/2732-136-0x0000000140000000-0x0000000140A82000-memory.dmp

Filesize
10.5MB

Download
memory/2732-137-0x0000000140000000-0x0000000140A82000-memory.dmp

Filesize
10.5MB

Download