e11337c42792606196eda4a6f9c9cd22cc9ba59feff9acf74022fb46fbdbf5b1

Analysis

max time kernel
158s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e11337c42792606196eda4a6f9c9cd22cc9ba59feff9acf74022fb46fbdbf5b1.exe
Size

5.5MB
MD5

bbbcfa4e934122ba0a96a9dff367cf5b
SHA1

3346a1ed1fdb4c33bc1956338f79f08f6dd34f26
SHA256

e11337c42792606196eda4a6f9c9cd22cc9ba59feff9acf74022fb46fbdbf5b1
SHA512

76d337708b20086888e5f3037d29f8a37bfd98f9eff125f6f2dd4bb5ae823c1ac76cebe54383bbb8ce038d27bf7f86bf96c6f585e21bf7c1c80e9b7317e63337
SSDEEP

98304:WGdZusmwYqdwkLcHHj5SbWf+YFCNK1oLZliOuz5+If9kuPJGGf6iOdDEvJ:v5jAjQaf+HNKcqkwG46Jw

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e11337c42792606196eda4a6f9c9cd22cc9ba59feff9acf74022fb46fbdbf5b1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2140	e11337c42792606196eda4a6f9c9cd22cc9ba59feff9acf74022fb46fbdbf5b1.exe

C:\Users\Admin\AppData\Local\Temp\e11337c42792606196eda4a6f9c9cd22cc9ba59feff9acf74022fb46fbdbf5b1.exe
"C:\Users\Admin\AppData\Local\Temp\e11337c42792606196eda4a6f9c9cd22cc9ba59feff9acf74022fb46fbdbf5b1.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2140-132-0x0000000000400000-0x0000000000977000-memory.dmp

Filesize
5.5MB

Download
memory/2140-133-0x0000000000400000-0x0000000000977000-memory.dmp

Filesize
5.5MB

Download