ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe
Size

1.6MB
MD5

bed8ecb9f67fbf62eb83e6cfb18fbdce
SHA1

f30ea267a57cacb73d57b13f3632e2bbbce4e0b6
SHA256

ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7
SHA512

c62cc40a68d7908fdffb9e0b127896793fad692864efd39a807690ac420fd77b6f77e95e72f38154644a4e2298a37b6580e031a7577af38582e5bfffaba6dca6
SSDEEP

49152:bVMgEV6piZUxF5dZlFlzt2Z+AtnciCnpVmIry5X3XH64YY0Gl+14ByqjtWHr3Q/E:bVMgEV6pLxF5fXlzts+AtnciCnpVmIrR

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2036	ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1648	2036	ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe	27
PID 2036 wrote to memory of 1648	2036	ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe	27
PID 2036 wrote to memory of 1648	2036	ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe	27
PID 2036 wrote to memory of 1648	2036	ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe	27

C:\Users\Admin\AppData\Local\Temp\ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe
"C:\Users\Admin\AppData\Local\Temp\ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe
  "C:\Users\Admin\AppData\Local\Temp\ee0cf03a33a368518ab5c280d2a25441640e3bb1f13037bcb19d2bea233e46c7.exe"
  2⤵
  PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-56-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/2036-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download
memory/2036-57-0x00000000023A0000-0x0000000002566000-memory.dmp

Filesize
1.8MB

Download
memory/2036-58-0x0000000000400000-0x00000000005C6000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads