1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3

Analysis

max time kernel
91s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe
Size

838KB
MD5

10b83714de8210be167a86c8a97daf80
SHA1

0ccba7999c7b15fb145a98cbeb821bd2e524e6a6
SHA256

1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3
SHA512

d09cd1d2046eadc3417b5ecb3d7409015a8747f2d2a62d03a6a987b0c511e4de6269407cddac495e41c78d757c9e2e592d6a67707dbf6af694dc3f2849abd84b
SSDEEP

12288:uW17poE9ZJtxGDSQISmsh7gu221pfGE72Y30bKtr1SaCC6T6:t1Fo6ZJPVsVgkUE7jNN1hi6

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4264	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe
2324	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe
3620	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4264	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe
4264	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 2324	4264	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe	81
PID 4264 wrote to memory of 2324	4264	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe	81
PID 4264 wrote to memory of 2324	4264	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe	81
PID 4264 wrote to memory of 3620	4264	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe	82
PID 4264 wrote to memory of 3620	4264	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe	82
PID 4264 wrote to memory of 3620	4264	1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe	82

C:\Users\Admin\AppData\Local\Temp\1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe
"C:\Users\Admin\AppData\Local\Temp\1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe
  start
  2⤵
  - Checks BIOS information in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Enumerates system info in registry
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\1c6a976906c0b6f8951a37dd806f9220d200d4c54951d1ac6ea650b919209df3.exe
  watch
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-138-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2324-144-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2324-149-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2324-141-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2324-147-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/2324-146-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/3620-142-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/3620-143-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/3620-145-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/3620-139-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/3620-148-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/3620-150-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/4264-133-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/4264-132-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/4264-135-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/4264-140-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/4264-134-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download