fa379ebe39f189ca71c16714ffa4f769a82d189769dbc9197f980982ed466419

Analysis

max time kernel
185s
max time network
231s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 16:38

Target

fa379ebe39f189ca71c16714ffa4f769a82d189769dbc9197f980982ed466419.exe
Size

319KB
MD5

e5452ae4c2c35326f449aa329936890c
SHA1

cf841a82c8de499faba0a70783c6c77fb86e60cc
SHA256

fa379ebe39f189ca71c16714ffa4f769a82d189769dbc9197f980982ed466419
SHA512

22cc18653c97b6927c167d67eae5cff953cea8deb8e8b38a98b1be8ab01b47a9ca23e56dc5c57378a42617ef3acb5c32b0eb35ee95fc562873f80e4a2564e3f1
SSDEEP

3072:soXc5FMRqnRNvAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZr:9kRNv+GIIIIIIIhIIIIIIIIIIIIIIIU

Score

7^/10

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

fa379ebe39f189ca71c16714ffa4f769a82d189769dbc9197f980982ed466419.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fa379ebe39f189ca71c16714ffa4f769a82d189769dbc9197f980982ed466419.exe

C:\Users\Admin\AppData\Local\Temp\fa379ebe39f189ca71c16714ffa4f769a82d189769dbc9197f980982ed466419.exe
"C:\Users\Admin\AppData\Local\Temp\fa379ebe39f189ca71c16714ffa4f769a82d189769dbc9197f980982ed466419.exe"
1⤵
- Checks BIOS information in registry
PID:2376

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2376-132-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download
memory/2376-133-0x0000000000400000-0x00000000004F4000-memory.dmp

Filesize
976KB

Download