Analysis
-
max time kernel
151s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:43
Static task
static1
Behavioral task
behavioral1
Sample
be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe
Resource
win10v2004-20221111-en
General
-
Target
be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe
-
Size
69KB
-
MD5
015c38766115fe00651137e6ba64c332
-
SHA1
6e3456a6a719f54b89768d6b9afb6031f0cab713
-
SHA256
be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0
-
SHA512
f04c585b20183e32677f9f23c5ea949a94041dcf82be5191018a133e4fc37222a241fb368fa13ce2513cf8b2fbd25716bed6ddba85ab97ebd3416175bbcfdd52
-
SSDEEP
1536:BDCfpfjEEvpPUY8pQ6WTIO0KRwYwOSlBrtrIxy0:BDmpfYch++TIOgBrtrIxy0
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe"C:\Users\Admin\AppData\Local\Temp\be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe"1⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exeC:\Users\Admin\AppData\Local\Temp\be2985adbd19bc31d64b9f94bc968bcb59c6a466a0eb48989b73e4e0a80300d0.exe1⤵
- Checks processor information in registry
PID:3852