ae09908549ccce2966bca0160110dd73bed903a1cd510d83cbdb9ffcd2b4f2e2

Analysis

max time kernel
206s
max time network
107s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

CNITרDDOS̬Ⱥѹ/Server.exe
Size

60KB
MD5

02a93eb66ac8ffbc3a04d1ad7631fb98
SHA1

d33475799123cba21989f34ab24357b1c3a4c00b
SHA256

e49a8f2327077207be5c0faa1fa79cb39560d337c27e0d6fc352b6d6e0b5d70c
SHA512

588f18601945c452b1526f255771c3afe6c26093d1c54d50db2e1116a5c9f8bfe6412aacdf70b6ae8c90a9c2d21d7d9fa2599d110cca9699433f0674b776db02
SSDEEP

768:jq+lzGCnBsNKIIBzJF1SLpuT/2b8JlFmzdtLWidiJz37oV:upAz1S9uTObq7MtDIY

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Server.exe

C:\Users\Admin\AppData\Local\Temp\CNITרDDOS̬Ⱥѹ\Server.exe
"C:\Users\Admin\AppData\Local\Temp\CNITרDDOS̬Ⱥѹ\Server.exe"
1⤵
- Checks processor information in registry
PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-54-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1088-55-0x0000000000230000-0x000000000023A000-memory.dmp

Filesize
40KB

Download
memory/1088-56-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1088-57-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download