Analysis
-
max time kernel
9s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 12:18
Static task
static1
Behavioral task
behavioral1
Sample
68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe
Resource
win10v2004-20220812-en
General
-
Target
68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe
-
Size
931KB
-
MD5
51ac9ebc39301af1590ea3ee52410d8b
-
SHA1
50b9724d3e7c04567206a494303e5c24df3102db
-
SHA256
68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451
-
SHA512
44659509a1bc295725b356efc86dab3768b3eee4ff8441f16f629a62cc8c33982277be32318c74abbe3ef8a3d6c1a0a110c7a7a94e24759a76604c978129b10e
-
SSDEEP
24576:i6IMwPvmB/wWq+5DUTt7FGSwmpu8nL6YKv:i6j19rut7FoU565
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/844-55-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral1/memory/844-57-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral1/memory/844-58-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral1/memory/844-62-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral1/memory/844-63-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral1/memory/844-64-0x0000000000400000-0x00000000004EA000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1756 set thread context of 844 1756 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe 28 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 844 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1756 wrote to memory of 844 1756 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe 28 PID 1756 wrote to memory of 844 1756 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe 28 PID 1756 wrote to memory of 844 1756 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe 28 PID 1756 wrote to memory of 844 1756 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe 28 PID 1756 wrote to memory of 844 1756 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe 28 PID 1756 wrote to memory of 844 1756 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe 28 PID 1756 wrote to memory of 844 1756 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe 28 PID 1756 wrote to memory of 844 1756 68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe"C:\Users\Admin\AppData\Local\Temp\68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe"C:\Users\Admin\AppData\Local\Temp\68f3f39a792d47c8be7f782c016c0fc2ab87695d5011dde7eb85380567880451.exe" Track="0001001000"2⤵
- Suspicious use of SetWindowsHookEx
PID:844
-