bdfc91a4bd37d52d6c11bdfabf5cb8ef3ca113b246e8d0319d730e7822e8e237

Analysis

max time kernel
46s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:36

Target

MirServer/LogServer/LogDataServer.exe
Size

986KB
MD5

a9b98bb188a0f6ff38cb94d6657981fb
SHA1

5609ee2bddbc219d0eddb5bd0d6eff395a204ec1
SHA256

68a14f070c477b05e0804635c8db4904b217aa8842f171fbeb5151b1f76c08e7
SHA512

3ed536d33e26ac62e74a066938fc8096882b8db8aff24f2519c54df7c61ccd33fbc1d92756d5562af01620d74cea7f9b148b99267c288e329c864e06dec7d70e
SSDEEP

24576:/cc+DzVchKHemUmv3ZtAq7qEPnwX2nZAB1nStjvsfTTVYBjknmnVR3Tjy:/izPLNb7bESZAKjvYvSBrDTjy

Score

7^/10

Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

LogDataServer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion LogDataServer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LogDataServer.exe

C:\Users\Admin\AppData\Local\Temp\MirServer\LogServer\LogDataServer.exe
"C:\Users\Admin\AppData\Local\Temp\MirServer\LogServer\LogDataServer.exe"
1⤵
- Checks BIOS information in registry
PID:1656

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1656-54-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1656-55-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1656-57-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1656-58-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1656-59-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download