6abb89f0b7a246d736bf4f69fd6db17b72cfeb82af0a1931880b37b6fb2ff8cd

Analysis

max time kernel
169s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6abb89f0b7a246d736bf4f69fd6db17b72cfeb82af0a1931880b37b6fb2ff8cd.exe
Size

22KB
MD5

292bb8ccc16540210ea0b147748757a6
SHA1

06854d1f0bcd938a3748ac146db43ab503f2179a
SHA256

6abb89f0b7a246d736bf4f69fd6db17b72cfeb82af0a1931880b37b6fb2ff8cd
SHA512

b49356e0b5b12e85c6e7e32241c0c827d3a39f3209796fe9555213dcbaf58122d42e299c819ad5216cf18aec0b0a22def529f055e38e186353012431033c307a
SSDEEP

384:0YImhoWVkxT5GEZpw4/fYzlvbWDUCElU8f6DW9TeVOtD1/lNcoOOuK+cyH:RDqxT5Jgaie4tpH1yH

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3484	tyhhyg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tyhhyg.exe	6abb89f0b7a246d736bf4f69fd6db17b72cfeb82af0a1931880b37b6fb2ff8cd.exe
File opened for modification	C:\Windows\SysWOW64\tyhhyg.exe	6abb89f0b7a246d736bf4f69fd6db17b72cfeb82af0a1931880b37b6fb2ff8cd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	tyhhyg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	tyhhyg.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1972	6abb89f0b7a246d736bf4f69fd6db17b72cfeb82af0a1931880b37b6fb2ff8cd.exe

C:\Users\Admin\AppData\Local\Temp\6abb89f0b7a246d736bf4f69fd6db17b72cfeb82af0a1931880b37b6fb2ff8cd.exe
"C:\Users\Admin\AppData\Local\Temp\6abb89f0b7a246d736bf4f69fd6db17b72cfeb82af0a1931880b37b6fb2ff8cd.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
PID:1972

C:\Windows\SysWOW64\tyhhyg.exe
C:\Windows\SysWOW64\tyhhyg.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\tyhhyg.exe

Filesize
22KB

MD5
292bb8ccc16540210ea0b147748757a6

SHA1
06854d1f0bcd938a3748ac146db43ab503f2179a

SHA256
6abb89f0b7a246d736bf4f69fd6db17b72cfeb82af0a1931880b37b6fb2ff8cd

SHA512
b49356e0b5b12e85c6e7e32241c0c827d3a39f3209796fe9555213dcbaf58122d42e299c819ad5216cf18aec0b0a22def529f055e38e186353012431033c307a

Download Submit
C:\Windows\SysWOW64\tyhhyg.exe

Filesize
22KB

MD5
292bb8ccc16540210ea0b147748757a6

SHA1
06854d1f0bcd938a3748ac146db43ab503f2179a

SHA256
6abb89f0b7a246d736bf4f69fd6db17b72cfeb82af0a1931880b37b6fb2ff8cd

SHA512
b49356e0b5b12e85c6e7e32241c0c827d3a39f3209796fe9555213dcbaf58122d42e299c819ad5216cf18aec0b0a22def529f055e38e186353012431033c307a

Download Submit