5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd

Analysis

max time kernel
168s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
Size

734KB
MD5

83a13048952eb0917ebbf673b96b18a4
SHA1

27f2b8b814e8746bce63e72098a3a7e41d0902b9
SHA256

5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd
SHA512

44894bff107d01b5316bcdde29f840c2994a066a775ab012598d15d1f7ae7722bccf08161d782728640cd6c3459ef57be6bba986cc06e5bd7976f49353a52bf0
SSDEEP

12288:fZ9P9SH3NcISew9d7tMsdYJZ3wYII1f7g1QQtM9HSy0A:T1SXqlGeYJZAYGMEy0A

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe

pid	process
1784	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
2772	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
484	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\ 5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe

pid	process
1784	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
1784	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe

description	pid	process	target process
PID 1784 wrote to memory of 2772	1784	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
PID 1784 wrote to memory of 2772	1784	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
PID 1784 wrote to memory of 2772	1784	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
PID 1784 wrote to memory of 484	1784	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
PID 1784 wrote to memory of 484	1784	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
PID 1784 wrote to memory of 484	1784	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe	5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe

C:\Users\Admin\AppData\Local\Temp\5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
"C:\Users\Admin\AppData\Local\Temp\5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1784

C:\Users\Admin\AppData\Local\Temp\5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
start
2⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
PID:2772

C:\Users\Admin\AppData\Local\Temp\5fdfe588a427c00dc404525a5b7e73d976c53078cfbc1c2deae645d9b2d9e4cd.exe
watch
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/484-140-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/484-136-0x0000000000000000-mapping.dmp

Download
memory/484-144-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1784-133-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1784-134-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1784-132-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/1784-138-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2772-135-0x0000000000000000-mapping.dmp

Download
memory/2772-139-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2772-141-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2772-142-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2772-143-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download
memory/2772-137-0x0000000000400000-0x00000000004BB000-memory.dmp

Filesize
748KB

Download