00fe9e04acdfc56ac57c845de8a80ad212f89489a58d9997efb2166eb23a03a9

Analysis

max time kernel
258s
max time network
361s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00fe9e04acdfc56ac57c845de8a80ad212f89489a58d9997efb2166eb23a03a9.exe
Size

280KB
MD5

b7d209cbedbb5ed94da0ad0d5b1ebc69
SHA1

3112d8f6f914c9967070fc635b44529cda3162aa
SHA256

00fe9e04acdfc56ac57c845de8a80ad212f89489a58d9997efb2166eb23a03a9
SHA512

09262731863fc41bd165015cbc19311ca8fd4dbf05867a5fb614ede170e929a0d02b0828a9d54090fc633065d4df3bfc733880b3bcbe585df85ffa703a29d0d5
SSDEEP

3072:gBBALhmAHQVm6S93tSMjWqJelj3PzAfPZynRPdygvkmvRplayfbHZMqXEb:OWntSMjFelT0fB04g8m5RHY

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	00fe9e04acdfc56ac57c845de8a80ad212f89489a58d9997efb2166eb23a03a9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	00fe9e04acdfc56ac57c845de8a80ad212f89489a58d9997efb2166eb23a03a9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	00fe9e04acdfc56ac57c845de8a80ad212f89489a58d9997efb2166eb23a03a9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	00fe9e04acdfc56ac57c845de8a80ad212f89489a58d9997efb2166eb23a03a9.exe

C:\Users\Admin\AppData\Local\Temp\00fe9e04acdfc56ac57c845de8a80ad212f89489a58d9997efb2166eb23a03a9.exe
"C:\Users\Admin\AppData\Local\Temp\00fe9e04acdfc56ac57c845de8a80ad212f89489a58d9997efb2166eb23a03a9.exe"
1⤵
- Checks processor information in registry
PID:472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...