4768a82ef03a57ddcbd78e8d6540689f568efe507f53d6f83d5d5ccbe290cc16

Analysis

max time kernel
144s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4768a82ef03a57ddcbd78e8d6540689f568efe507f53d6f83d5d5ccbe290cc16.exe
Size

40KB
MD5

c22c8dbe37acc30a4dbd98e6d67dbcc6
SHA1

26e455100da8773d46906de74ce2428d1dc61f1f
SHA256

4768a82ef03a57ddcbd78e8d6540689f568efe507f53d6f83d5d5ccbe290cc16
SHA512

d34486a912fd25a5bf4b176e2a30351d36ed436f1144e566b04e608dd6e6f1b254fad534b1c8cfbd7f40f5dbbba97e0d5addae9e9821e360d6d5168090633382
SSDEEP

384:1WUgLQC3uHIKd0+A7CtU4CNuGl7lVHVaH4puijQcmROrKhfOnATEjE18mYxBj1l6:1W/feQtlVbFmROrYymCBJlNw1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4144	System.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System.exe	4768a82ef03a57ddcbd78e8d6540689f568efe507f53d6f83d5d5ccbe290cc16.exe
File opened for modification	C:\Windows\System.exe	4768a82ef03a57ddcbd78e8d6540689f568efe507f53d6f83d5d5ccbe290cc16.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	System.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	System.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3064	4768a82ef03a57ddcbd78e8d6540689f568efe507f53d6f83d5d5ccbe290cc16.exe

C:\Users\Admin\AppData\Local\Temp\4768a82ef03a57ddcbd78e8d6540689f568efe507f53d6f83d5d5ccbe290cc16.exe
"C:\Users\Admin\AppData\Local\Temp\4768a82ef03a57ddcbd78e8d6540689f568efe507f53d6f83d5d5ccbe290cc16.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
PID:3064

C:\Windows\System.exe
C:\Windows\System.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System.exe

Filesize
40KB

MD5
c22c8dbe37acc30a4dbd98e6d67dbcc6

SHA1
26e455100da8773d46906de74ce2428d1dc61f1f

SHA256
4768a82ef03a57ddcbd78e8d6540689f568efe507f53d6f83d5d5ccbe290cc16

SHA512
d34486a912fd25a5bf4b176e2a30351d36ed436f1144e566b04e608dd6e6f1b254fad534b1c8cfbd7f40f5dbbba97e0d5addae9e9821e360d6d5168090633382

Download Submit
C:\Windows\System.exe

Filesize
40KB

MD5
c22c8dbe37acc30a4dbd98e6d67dbcc6

SHA1
26e455100da8773d46906de74ce2428d1dc61f1f

SHA256
4768a82ef03a57ddcbd78e8d6540689f568efe507f53d6f83d5d5ccbe290cc16

SHA512
d34486a912fd25a5bf4b176e2a30351d36ed436f1144e566b04e608dd6e6f1b254fad534b1c8cfbd7f40f5dbbba97e0d5addae9e9821e360d6d5168090633382

Download Submit