b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67

Analysis

max time kernel
106s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe
Size

1.0MB
MD5

501c162e8283ef94ed68511838f7ae4b
SHA1

9e0c453bac5cee7f444da3c30d121830e960aa5e
SHA256

b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67
SHA512

5642c3ab496476e1b4d3d22387ee65baccfe7095fa0162f109d925792707bbc9bf246be99400a5593bc75aa4e2783365f4985d16d24592a028660ef049b211a3
SSDEEP

24576:FIH2tDv0iOX8V2fIlzikiEv9ywoL77h6VFWwmb1/Ahx5jD:MiOgEkiqO77h6VFXckzf

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12BE6E64-6F91-D31D-44F3-7C99EDEED405}\ = "PSFactoryBuffer"	b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12BE6E64-6F91-D31D-44F3-7C99EDEED405}\InProcServer32	b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12BE6E64-6F91-D31D-44F3-7C99EDEED405}\InProcServer32\ = "C:\\Windows\\SysWOW64\\thumbcache.dll"	b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12BE6E64-6F91-D31D-44F3-7C99EDEED405}\InProcServer32\ThreadingModel = "Both"	b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12BE6E64-6F91-D31D-44F3-7C99EDEED405}	b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3984	b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe
Token: SeIncBasePriorityPrivilege	3984	b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3984	b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe

C:\Users\Admin\AppData\Local\Temp\b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe
"C:\Users\Admin\AppData\Local\Temp\b283181a93730882ebd53c4bb747113b9c1bd70a97251d816205becf4b001f67.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3984-133-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/3984-135-0x00000000008F0000-0x0000000000954000-memory.dmp

Filesize
400KB

Download
memory/3984-140-0x00000000008F1000-0x0000000000926000-memory.dmp

Filesize
212KB

Download
memory/3984-141-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/3984-144-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/3984-145-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/3984-143-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/3984-142-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/3984-148-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download