c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994

General

Target

c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Size

1.4MB
MD5

fa71a145579c659f510f9234c258d531
SHA1

95b8ff9cecc4a40e17bc3c07aa6dd7a9cee1f787
SHA256

c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994
SHA512

0d63c73c52bf54ac2599a0812f9742bf43980263075309816bc396e16268f4befdbfd6c11501a55b66bf95312f510e26ffefbadf197a6fec4106277a976051de
SSDEEP

24576:KgGvdDAcsF8roeuLx4JWw0gAlFy82OZtPTIr6nK2SL3PP2C3LDNu1:wyiolLxkb0Vzpkr6XSzPV3/Y

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

description	pid	process
Token: SeBackupPrivilege	1460	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Token: SeRestorePrivilege	1460	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Token: 33	1460	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Token: SeIncBasePriorityPrivilege	1460	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

C:\Users\Admin\AppData\Local\Temp\c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
"C:\Users\Admin\AppData\Local\Temp\c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-54-0x0000000140000000-0x00000001402DD000-memory.dmp

Filesize
2.9MB

Download
memory/1460-55-0x0000000002080000-0x0000000002668000-memory.dmp

Filesize
5.9MB

Download
memory/1460-56-0x0000000002080000-0x0000000002668000-memory.dmp

Filesize
5.9MB

Download
memory/1460-57-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/1460-58-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-60-0x0000000002080000-0x0000000002668000-memory.dmp

Filesize
5.9MB

Download
memory/1460-59-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-61-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-63-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-62-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-64-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-69-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-70-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-72-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-71-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-68-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-67-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-66-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-65-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-73-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-74-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-75-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-76-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-77-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-78-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-79-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-80-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-81-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-82-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-83-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-84-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-85-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-86-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-87-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-88-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-89-0x0000000001BAB000-0x0000000001BB0000-memory.dmp

Filesize
20KB

Download
memory/1460-91-0x0000000140000000-0x00000001402DD000-memory.dmp

Filesize
2.9MB

Download
memory/1460-92-0x0000000002080000-0x0000000002668000-memory.dmp

Filesize
5.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads