3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0

General

Target

3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Size

2.0MB
MD5

99c28f4b7977f13e8183e1fc040cf2c3
SHA1

21012c791ccb7dd448f9bf2c9755ed5bfb755423
SHA256

3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0
SHA512

547dcb2c3fab3dca7f3a0c7df1b5040295ba20260a3b65af00d7efef27f35454903943f876370d7d93a0b731da073557b29e35742a9cf9fcb0bff5dc72c75b92
SSDEEP

49152:+fST4GMpLdTO92WrA48hHX9uY3yDX16ivRgQbh8c9c4z3:lBMm92c8hHgb1zvRVbzNr

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B1DBADA-280C-77FD-FB89-137F5620A4B6}	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B1DBADA-280C-77FD-FB89-137F5620A4B6}\Implemented Categories	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B1DBADA-280C-77FD-FB89-137F5620A4B6}\InProcServer32	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B1DBADA-280C-77FD-FB89-137F5620A4B6}\tabsets\location = "257"	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B1DBADA-280C-77FD-FB89-137F5620A4B6}\ = "Cabinet Shell Folder"	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B1DBADA-280C-77FD-FB89-137F5620A4B6}\Implemented Categories\{00021490-0000-0000-C000-000000000046}	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B1DBADA-280C-77FD-FB89-137F5620A4B6}\InProcServer32\ = "%SystemRoot%\\SysWow64\\cabview.dll"	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B1DBADA-280C-77FD-FB89-137F5620A4B6}\InProcServer32\ThreadingModel = "Apartment"	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B1DBADA-280C-77FD-FB89-137F5620A4B6}\ShellFolder	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B1DBADA-280C-77FD-FB89-137F5620A4B6}\ShellFolder\Attributes = "1744830880"	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B1DBADA-280C-77FD-FB89-137F5620A4B6}\tabsets	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4928	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
Token: SeIncBasePriorityPrivilege	4928	3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe

C:\Users\Admin\AppData\Local\Temp\3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe
"C:\Users\Admin\AppData\Local\Temp\3795d1e566fa3417a2b23b7b176772bb7fbe740c62cb4fd84bfdebf4c380f4d0.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4928-133-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download
memory/4928-134-0x0000000002690000-0x00000000027D3000-memory.dmp

Filesize
1.3MB

Download
memory/4928-140-0x0000000002691000-0x0000000002788000-memory.dmp

Filesize
988KB

Download
memory/4928-141-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download
memory/4928-142-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download
memory/4928-143-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-144-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-145-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-146-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-148-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-149-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-147-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-150-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-151-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-153-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-152-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-154-0x0000000000401000-0x00000000004A4000-memory.dmp

Filesize
652KB

Download
memory/4928-155-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download
memory/4928-156-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download
memory/4928-157-0x0000000000400000-0x00000000006DA000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing