500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca

Analysis

max time kernel
143s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe
Size

1.1MB
MD5

7dfa93b2854cc25c3bfba058f330b4f5
SHA1

94e322516763e41e26a58e24edae563555c3c555
SHA256

500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca
SHA512

3ef4a2f8819f7aaa4b2c76f06181860c8a0bfc731010db8889d835ca5c71c8709ab34af6b3df72e366f939fe4ade1bceec3155c3490eba7ecfd0635d6bb5226c
SSDEEP

24576:RjM9EO9YCDHHyajexzJEUtyZbR2nptKyT/MycBOkb25p9X:KTD/Gzeyyx8ptKicBlChX

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4180-132-0x0000000000400000-0x000000000057D000-memory.dmp	upx
behavioral2/memory/4180-136-0x0000000000400000-0x000000000057D000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4180 set thread context of 224	4180	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe	80

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
224	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe
224	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe
224	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe
224	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe
224	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe
224	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 224	4180	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe	80
PID 4180 wrote to memory of 224	4180	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe	80
PID 4180 wrote to memory of 224	4180	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe	80
PID 4180 wrote to memory of 224	4180	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe	80
PID 4180 wrote to memory of 224	4180	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe	80
PID 4180 wrote to memory of 224	4180	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe	80
PID 4180 wrote to memory of 224	4180	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe	80
PID 4180 wrote to memory of 224	4180	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe	80
PID 4180 wrote to memory of 224	4180	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe	80
PID 4180 wrote to memory of 224	4180	500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe	80

C:\Users\Admin\AppData\Local\Temp\500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe
"C:\Users\Admin\AppData\Local\Temp\500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe
  "C:\Users\Admin\AppData\Local\Temp\500b835ef09e2e43e34e4a45715216de905308d5d0d95df5824130643a68eeca.exe" Track="0001001000"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/224-134-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/224-135-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/224-137-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/224-138-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/224-139-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/224-140-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/4180-132-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/4180-136-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads