3dea9ed08f537b5a9fce1880ff9804afe28dc1f3b521f565a61c6cf2876bc9ae

Analysis

max time kernel
15s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dea9ed08f537b5a9fce1880ff9804afe28dc1f3b521f565a61c6cf2876bc9ae.exe
Size

5.8MB
MD5

6e52438b780f6761465441d8e22ece3b
SHA1

9841ab821909043fdab2e8aae795d99508323b80
SHA256

3dea9ed08f537b5a9fce1880ff9804afe28dc1f3b521f565a61c6cf2876bc9ae
SHA512

e9c7faa9ca109efb8cb470fe9ee15dd8be5feafe122881b97f75e51161879f1892b083e6cfc8c13112446183f9b081d3780d9ad445a93416fa425b8117762b4e
SSDEEP

98304:52LV6eaSLm/cR94IXsYmVG0VqK4yXmJqyd2R4gcL9d6k8Zjsc2rbfA2C:52vaLcR9BXsYIGKqqXmkr4gcrQjscwbE

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	3dea9ed08f537b5a9fce1880ff9804afe28dc1f3b521f565a61c6cf2876bc9ae.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	3dea9ed08f537b5a9fce1880ff9804afe28dc1f3b521f565a61c6cf2876bc9ae.exe

C:\Users\Admin\AppData\Local\Temp\3dea9ed08f537b5a9fce1880ff9804afe28dc1f3b521f565a61c6cf2876bc9ae.exe
"C:\Users\Admin\AppData\Local\Temp\3dea9ed08f537b5a9fce1880ff9804afe28dc1f3b521f565a61c6cf2876bc9ae.exe"
1⤵
- Checks processor information in registry
PID:1212

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x180
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-54-0x0000000075EC1000-0x0000000075EC3000-memory.dmp

Filesize
8KB

Download