2fd0955239725526a99dee6a38a48cf5174099b9a055f9cc1b77bdb09ce3bef1

Analysis

max time kernel
47s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fd0955239725526a99dee6a38a48cf5174099b9a055f9cc1b77bdb09ce3bef1.dll
Size

896KB
MD5

a099093e5be562fc9ff4891fe3dfacf1
SHA1

8fee44f7b66b0ec0d9b530b3a2179b0f95a7986e
SHA256

2fd0955239725526a99dee6a38a48cf5174099b9a055f9cc1b77bdb09ce3bef1
SHA512

504350c91556471ff1ec69b79ee995c5ed4e47a91a50c4ffb78068736eb583a667eef067f013630a54b7c2ca90edfd09f4d7771417e36bc65885cdfc2bd4c936
SSDEEP

24576:XHzlWaTX7IfgFKdpfjTEzTravW0d5VjhRRr92TA:XxwoF4pfjY7avWmjr92E

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1740	884	rundll32.exe	28
PID 884 wrote to memory of 1740	884	rundll32.exe	28
PID 884 wrote to memory of 1740	884	rundll32.exe	28
PID 884 wrote to memory of 1740	884	rundll32.exe	28
PID 884 wrote to memory of 1740	884	rundll32.exe	28
PID 884 wrote to memory of 1740	884	rundll32.exe	28
PID 884 wrote to memory of 1740	884	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fd0955239725526a99dee6a38a48cf5174099b9a055f9cc1b77bdb09ce3bef1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fd0955239725526a99dee6a38a48cf5174099b9a055f9cc1b77bdb09ce3bef1.dll,#1
  2⤵
  - Checks BIOS information in registry
  PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-55-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1740-56-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-57-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-58-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-59-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-60-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-61-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-62-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-63-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-64-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-66-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-68-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-69-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download
memory/1740-70-0x0000000010000000-0x00000000102CE000-memory.dmp

Filesize
2.8MB

Download