e9b21bbb5e418b0185091e845a247152e5f93312176434ecf5ec5b38d98b439a

Analysis

max time kernel
132s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:28

Target

e9b21bbb5e418b0185091e845a247152e5f93312176434ecf5ec5b38d98b439a.exe
Size

69KB
MD5

5e17adb1fa641ce020dc1a01c4db9641
SHA1

2adbae98c8c1056f08095040a6017a3e39097dc8
SHA256

e9b21bbb5e418b0185091e845a247152e5f93312176434ecf5ec5b38d98b439a
SHA512

bd99fa26ba8da2a09b55be4c5d6a983379ae6cb96f0c2ef4e9796c7427443b668954ab4e48a91b08c5a25155c0c3f3aced308a67f61887b4223f7b3e6062d04c
SSDEEP

1536:j9pgn70w9J2aYZ7vlphkfjFynM9dmfUzwzZtK5b3XF:pprwWaYFvlf6ynWmfUz15zF

Score

1^/10

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

e9b21bbb5e418b0185091e845a247152e5f93312176434ecf5ec5b38d98b439a.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	e9b21bbb5e418b0185091e845a247152e5f93312176434ecf5ec5b38d98b439a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e9b21bbb5e418b0185091e845a247152e5f93312176434ecf5ec5b38d98b439a.exe

C:\Users\Admin\AppData\Local\Temp\e9b21bbb5e418b0185091e845a247152e5f93312176434ecf5ec5b38d98b439a.exe
"C:\Users\Admin\AppData\Local\Temp\e9b21bbb5e418b0185091e845a247152e5f93312176434ecf5ec5b38d98b439a.exe"
1⤵
- Checks processor information in registry
PID:1948

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1948-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download