be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0

Analysis

max time kernel
144s
max time network
174s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:43

Target

be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe
Size

69KB
MD5

015c38766115fe00651137e6ba64c332
SHA1

6e3456a6a719f54b89768d6b9afb6031f0cab713
SHA256

be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0
SHA512

f04c585b20183e32677f9f23c5ea949a94041dcf82be5191018a133e4fc37222a241fb368fa13ce2513cf8b2fbd25716bed6ddba85ab97ebd3416175bbcfdd52
SSDEEP

1536:BDCfpfjEEvpPUY8pQ6WTIO0KRwYwOSlBrtrIxy0:BDmpfYch++TIOgBrtrIxy0

Score

1^/10

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe

C:\Users\Admin\AppData\Local\Temp\be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe
"C:\Users\Admin\AppData\Local\Temp\be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe"
1⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe
C:\Users\Admin\AppData\Local\Temp\be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe
1⤵
- Checks processor information in registry
PID:1528

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1252-54-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download