c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994

General

Target

c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Size

1.4MB
MD5

fa71a145579c659f510f9234c258d531
SHA1

95b8ff9cecc4a40e17bc3c07aa6dd7a9cee1f787
SHA256

c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994
SHA512

0d63c73c52bf54ac2599a0812f9742bf43980263075309816bc396e16268f4befdbfd6c11501a55b66bf95312f510e26ffefbadf197a6fec4106277a976051de
SSDEEP

24576:KgGvdDAcsF8roeuLx4JWw0gAlFy82OZtPTIr6nK2SL3PP2C3LDNu1:wyiolLxkb0Vzpkr6XSzPV3/Y

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

description	pid	process
Token: SeBackupPrivilege	4648	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Token: SeRestorePrivilege	4648	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Token: 33	4648	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
Token: SeIncBasePriorityPrivilege	4648	c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe

C:\Users\Admin\AppData\Local\Temp\c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe
"C:\Users\Admin\AppData\Local\Temp\c82e41803063d2b3a5ef635e37ec94e901ae56b202ab7d2f985abd5948050994.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4648-132-0x0000000140000000-0x00000001402DD000-memory.dmp

Filesize
2.9MB

Download
memory/4648-133-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-134-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-135-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-136-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-137-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-138-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-139-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-140-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-141-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-142-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-143-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-144-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-145-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-146-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-147-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-149-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-148-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-150-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-151-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-152-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-153-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-154-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-155-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-156-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-157-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-158-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-159-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-160-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-161-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-162-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-163-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-164-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-165-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-166-0x000000000215A000-0x000000000215F000-memory.dmp

Filesize
20KB

Download
memory/4648-171-0x0000000140000000-0x00000001402DD000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads