794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8

Analysis

max time kernel
351s
max time network
401s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe
Size

1.5MB
MD5

8f242164405cd8dd7be8921f6b627701
SHA1

caf08f15ededa33c14228d313f824cb7a50a6865
SHA256

794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8
SHA512

ca0ef40bb62264d60610cf2ae10bb28e643a3e9fc3a2e22628b4f1138c4fa141d215791790b0f8463c14309d5ce28a5a81938d5b64b261fea6830e85b08eed7d
SSDEEP

24576:B9I81bci/CI2iz3vlMxNkJ5kfsvKHingfL1HSp1IiHGwrrJKqZEu4bp0xit3C+Xh:TIubci/8C5k4KHqgj14nVJKqZCFCUN

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe

C:\Users\Admin\AppData\Local\Temp\794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe
"C:\Users\Admin\AppData\Local\Temp\794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8.exe"
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:4432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4432-132-0x0000000000400000-0x0000000000743000-memory.dmp

Filesize
3.3MB

Download
memory/4432-133-0x0000000000400000-0x0000000000743000-memory.dmp

Filesize
3.3MB

Download