Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
01/12/2022, 05:41
General
-
Target
202bb667aec1a62b88b364dbad41c09d164e79b32a5f1823a633ced8bf9fd677.exe
-
Size
918KB
-
MD5
7500401571915dbba590ebf8c4f5cba0
-
SHA1
88a67d4db4205fb5b63f796be56da4dd898160ed
-
SHA256
202bb667aec1a62b88b364dbad41c09d164e79b32a5f1823a633ced8bf9fd677
-
SHA512
f8d996850925fa5e5503c2faf736b60a4c42ed9a0346c84b6ccc4c00e76fbfc6bae4dbd2506dd41c59bcbca5b9367aa9a6b7e9874d9fb530abe4ba9b8a5f56e9
-
SSDEEP
1536:i4OObhOhTPs3mK+rOMRsngTMj5qwYpslkOXoicUb:i4zbhWleMQyMtVSslZXoi9
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\202bb667aec1a62b88b364dbad41c09d164e79b32a5f1823a633ced8bf9fd677.exe"C:\Users\Admin\AppData\Local\Temp\202bb667aec1a62b88b364dbad41c09d164e79b32a5f1823a633ced8bf9fd677.exe"1⤵
- Adds policy Run key to start application
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskcompr.exeC:\Windows\SysWOW64\taskcompr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe/c C:\Users\Admin\AppData\Local\Temp\~unins4006.bat "C:\Users\Admin\AppData\Local\Temp\202bb667aec1a62b88b364dbad41c09d164e79b32a5f1823a633ced8bf9fd677.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49B
MD59e0a2f5ab30517809b95a1ff1dd98c53
SHA15c1eefdf10e67d1e9216e2e3f5e92352d583c9ce
SHA25697ac9fee75a1f7b63b3115e9c4fb9dda80b1caba26d2fb51325670dee261fe32
SHA512e959cc1fd48fb1cccf135a697924c775a3812bab211fc7f9b00c5a9d617261d84c5d6f7cb548774c1e8f46811b06ca39c5603d0e10cbcb7b805f9abbe49b9b42
-
Filesize
308KB
MD5bf47171acc372d42c92cb5a2333b9ff0
SHA160586dc14c9ab969e96c7850efaac709852bcefa
SHA2569e2716ab111fc7a675e15bf6e73e111b807468be55c4a54734068eb8022440a3
SHA5121e58a28f599c4184c31571aa1d745704895f30d0c62e0ff81114f4c6a2351d5e8d3873d2ef77fa4a42915609a00463c384957e3b4dd420f9ae609432d968055c
-
Filesize
308KB
MD5bf47171acc372d42c92cb5a2333b9ff0
SHA160586dc14c9ab969e96c7850efaac709852bcefa
SHA2569e2716ab111fc7a675e15bf6e73e111b807468be55c4a54734068eb8022440a3
SHA5121e58a28f599c4184c31571aa1d745704895f30d0c62e0ff81114f4c6a2351d5e8d3873d2ef77fa4a42915609a00463c384957e3b4dd420f9ae609432d968055c
-
Filesize
840KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
412KB
-
Filesize
420KB
-
Filesize
840KB
-
Filesize
420KB
-
Filesize
64KB
-
Filesize
840KB
-
Filesize
412KB
-
Filesize
5.7MB
-
Filesize
5.7MB