Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 14:52
Behavioral task
behavioral1
Sample
e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe
Resource
win7-20220812-en
General
-
Target
e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe
-
Size
745KB
-
MD5
0c889fc6cbcf65bf6e9dd3810af1544a
-
SHA1
4f1ef89232de53b1fa7dfe732243a4f6e4555d4c
-
SHA256
e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29
-
SHA512
64bbabfa1cbd55489d854c5507486caadb18fb6bfd2f6a56693c16d142cbab91072457f940edcfc9e1b12f0ed02e973b4043f6010c92dbef725745488251b073
-
SSDEEP
12288:oaAchpWsuVTv7ItY8XljyypHP3cOLBev03hlULsmWZ++09ZcKDVsgdBl:JAEENIq8XwyVPMclDq/+WnpsS
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeSecurityPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeTakeOwnershipPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeLoadDriverPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeSystemProfilePrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeSystemtimePrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeProfSingleProcessPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeIncBasePriorityPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeCreatePagefilePrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeBackupPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeRestorePrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeShutdownPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeDebugPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeSystemEnvironmentPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeChangeNotifyPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeRemoteShutdownPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeUndockPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeManageVolumePrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeImpersonatePrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: SeCreateGlobalPrivilege 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: 33 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: 34 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe Token: 35 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 768 e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe"C:\Users\Admin\AppData\Local\Temp\e309654b706d88938f16f6bef7a53e5ffad226d6a0d90167bf4d57de8a3d4a29.exe"1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:768