Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 03:44
Static task
static1
Behavioral task
behavioral1
Sample
08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe
Resource
win10v2004-20220901-en
General
-
Target
08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe
-
Size
1.0MB
-
MD5
9023ad4a4c4499f33c5acb75e019e77b
-
SHA1
6ea7020ed845675d6945974bc62018e5aff4cbe8
-
SHA256
08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59
-
SHA512
2a684fceb1432f49ec6a5ab2d7b6ec39c7454ab5513a2c55545475ca02e858130b377ba231eec54cbac98996e93b758f685423d5ebb9b21a3fdfdb16eacc44f3
-
SSDEEP
24576:zlafNPaNMDJOpKROZRpulZBVOkeOLimGHCmO+o:RaANaRGRpuHetmGimZo
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3224 set thread context of 1312 3224 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 82 -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1312 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 1312 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 1312 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 1312 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 1312 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 1312 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3224 wrote to memory of 1312 3224 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 82 PID 3224 wrote to memory of 1312 3224 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 82 PID 3224 wrote to memory of 1312 3224 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 82 PID 3224 wrote to memory of 1312 3224 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 82 PID 3224 wrote to memory of 1312 3224 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 82 PID 3224 wrote to memory of 1312 3224 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 82 PID 3224 wrote to memory of 1312 3224 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 82 PID 3224 wrote to memory of 1312 3224 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 82 PID 3224 wrote to memory of 1312 3224 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 82 PID 3224 wrote to memory of 1312 3224 08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe"C:\Users\Admin\AppData\Local\Temp\08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe"C:\Users\Admin\AppData\Local\Temp\08f74397735c55ecbe4edebcfb4f6232b5b56f82d2ed946ac483d445f79a1f59.exe" Track="0001001000"2⤵
- Suspicious use of SetWindowsHookEx
PID:1312
-