bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121

General

Target

bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
Size

600KB
MD5

789b444b7696708080e79c255980a9ab
SHA1

9502ee0053f0fddba4c883267105f14a4c1dcdd4
SHA256

bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121
SHA512

06cc4b4670ed4bc1888afff4936b0489994d80c1acc008ac09a4c36bc7223c9a8dc1a9df86860daec128b1a32aa5cf162d198b6952a383b4fc0149bd08458fb4
SSDEEP

12288:vnp7MTrnNc4cMCEASQPCnXYjCsCutCfAIh+ww3dJ:PpITTNcmkS0CnIjoNhatJ

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1740	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
1740	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
1740	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
1740	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
1740	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
1740	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27
PID 1872 wrote to memory of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27
PID 1872 wrote to memory of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27
PID 1872 wrote to memory of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27
PID 1872 wrote to memory of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27
PID 1872 wrote to memory of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27
PID 1872 wrote to memory of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27
PID 1872 wrote to memory of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27
PID 1872 wrote to memory of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27
PID 1872 wrote to memory of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27
PID 1872 wrote to memory of 1740	1872	bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe	27

C:\Users\Admin\AppData\Local\Temp\bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
"C:\Users\Admin\AppData\Local\Temp\bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe
  "C:\Users\Admin\AppData\Local\Temp\bb636dfcec5ac4efbe42204ad1f47a4a991e960cf811e7428cffc3ec26a45121.exe" Track="0001001000"
  2⤵
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-64-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1740-56-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1740-57-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1740-59-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1740-62-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1740-75-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1740-74-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1740-73-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1740-66-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1740-68-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/1740-72-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1872-70-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1872-55-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download
memory/1872-61-0x0000000002450000-0x000000000250F000-memory.dmp

Filesize
764KB

Download
memory/1872-54-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads