bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d

Analysis

max time kernel
179s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
Size

1.1MB
MD5

a60c8526ddf9d185f1d4e6308171f9ff
SHA1

8cf5cc529cb724749f6ccf9c567d5bb5781567b8
SHA256

bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d
SHA512

8630af40f3ef7ff0f8b48796173485105f1b0c3593745f9b332a9f3a6e112cdce4b4d6f8a81a6972bec7af82c50c15aa4528f686bc0927480af621150af19d7a
SSDEEP

24576:j8vLvb1yMby1E51gyoMD/9+rSOPTW8prq:jWtbKELB6rhW8hq

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2288 set thread context of 2036	2288	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe	81

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
2036	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
2036	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
2036	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
2036	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
2036	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2036	2288	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe	81
PID 2288 wrote to memory of 2036	2288	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe	81
PID 2288 wrote to memory of 2036	2288	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe	81
PID 2288 wrote to memory of 2036	2288	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe	81
PID 2288 wrote to memory of 2036	2288	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe	81
PID 2288 wrote to memory of 2036	2288	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe	81
PID 2288 wrote to memory of 2036	2288	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe	81
PID 2288 wrote to memory of 2036	2288	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe	81
PID 2288 wrote to memory of 2036	2288	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe	81
PID 2288 wrote to memory of 2036	2288	bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe	81

C:\Users\Admin\AppData\Local\Temp\bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
"C:\Users\Admin\AppData\Local\Temp\bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe
  "C:\Users\Admin\AppData\Local\Temp\bd7df4dc387db3386f99cbf6062b2a629670565824a509b34f531a094c0ba83d.exe" Track="0001001000"
  2⤵
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-134-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2036-135-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2036-136-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2036-137-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/2036-138-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads