Analysis
-
max time kernel
323s -
max time network
340s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 10:17
Static task
static1
Behavioral task
behavioral1
Sample
2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe
Resource
win10v2004-20221111-en
General
-
Target
2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe
-
Size
387KB
-
MD5
d6d6d27303c3973260df1e53851c4688
-
SHA1
ef25c92f968474881d5848ed341147056f6a5d1d
-
SHA256
2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9
-
SHA512
a3b7cba71138e3048ea083ab54df619c50c64be49e8f57074a5c5e5bbfe553eb9042ce5bb906c28978fdd346503e7893c09e9efc3da9830d0422f2981450f5b2
-
SSDEEP
6144:10BA3khqL1bcCVENChPsvk5IEK3pVVcqNcfCMnNBEb2/Ar7:10BACqRb2UPscW3jDNcKMPEqE
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exedescription pid process target process PID 4100 set thread context of 3312 4100 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exepid process 4100 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exedescription pid process target process PID 4100 wrote to memory of 3312 4100 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe PID 4100 wrote to memory of 3312 4100 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe PID 4100 wrote to memory of 3312 4100 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe PID 4100 wrote to memory of 3312 4100 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe PID 4100 wrote to memory of 3312 4100 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe PID 4100 wrote to memory of 3312 4100 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe PID 4100 wrote to memory of 3312 4100 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe PID 4100 wrote to memory of 3312 4100 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe PID 4100 wrote to memory of 3312 4100 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe 2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe"C:\Users\Admin\AppData\Local\Temp\2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe"C:\Users\Admin\AppData\Local\Temp\2d243f2d47e2a65be3c81fc6ffc4faa34b8bf38234f1b6d0503f3e6c3c7446f9.exe"2⤵
- Checks processor information in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3312-132-0x0000000000000000-mapping.dmp
-
memory/3312-133-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/3312-134-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/3312-135-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/3312-137-0x0000000000ED0000-0x0000000000F1B000-memory.dmpFilesize
300KB
-
memory/3312-138-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/3312-139-0x0000000000ED0000-0x0000000000F1B000-memory.dmpFilesize
300KB
-
memory/3312-140-0x0000000002BC0000-0x0000000002BCB000-memory.dmpFilesize
44KB