Analysis

  • max time kernel
    40s
  • max time network
    67s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 08:21

General

  • Target

    b28a48bdaa129d71dc06a14d09062f5d9a88ff261d012d3da219a067938c2641.exe

  • Size

    1.0MB

  • MD5

    d761d0388e6072d7974c63778c893146

  • SHA1

    b17479f0122457a78c95a4fcc4f29da406402a38

  • SHA256

    b28a48bdaa129d71dc06a14d09062f5d9a88ff261d012d3da219a067938c2641

  • SHA512

    9a1a9f603851ef6c784c5cc679e6f81319dc44b316702e10442f179499ae9a1544f896f84bb7c9c6c301d583c6e74bfa688f041d96424416d347b977a769d705

  • SSDEEP

    24576:ilafNPaNMDJOpKROZRpulZBVOkeOLimGHCmO+:CaANaRGRpuHetmGimZ

Score
7/10

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b28a48bdaa129d71dc06a14d09062f5d9a88ff261d012d3da219a067938c2641.exe
    "C:\Users\Admin\AppData\Local\Temp\b28a48bdaa129d71dc06a14d09062f5d9a88ff261d012d3da219a067938c2641.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Users\Admin\AppData\Local\Temp\b28a48bdaa129d71dc06a14d09062f5d9a88ff261d012d3da219a067938c2641.exe
      "C:\Users\Admin\AppData\Local\Temp\b28a48bdaa129d71dc06a14d09062f5d9a88ff261d012d3da219a067938c2641.exe" Track="0001001000"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1288

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1288-64-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1288-72-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1288-56-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1288-58-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1288-60-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1288-62-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1288-66-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1288-73-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1288-55-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1288-70-0x0000000074C91000-0x0000000074C93000-memory.dmp

    Filesize

    8KB

  • memory/1288-71-0x0000000000400000-0x00000000004F6000-memory.dmp

    Filesize

    984KB

  • memory/1776-69-0x0000000000400000-0x0000000000581000-memory.dmp

    Filesize

    1.5MB

  • memory/1776-54-0x0000000000230000-0x0000000000233000-memory.dmp

    Filesize

    12KB