af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc.exe
Size

8.1MB
MD5

5b190803539cbf54e01ab916bc9e5775
SHA1

41655ef05ecd8fd23bb7353ae899befc28b4cfa8
SHA256

af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc
SHA512

cd39a20a1fab5cb839a3f6e9ccc02cc98db2605598f399f57e206ed93f322119986f77e67739eec859e022d90da848be0c569535d59cdf1e55e80abc91c3e234
SSDEEP

196608:VYB0G/rIPtsjCrEkOg9N1dXGR2JA7Qx2r:iB9IPts2rEA9N1dXGR2JAc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2224	af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc.exe
2224	af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc.exe

C:\Users\Admin\AppData\Local\Temp\af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc.exe
"C:\Users\Admin\AppData\Local\Temp\af557264caf92303814bb369dc75f3c3a5f14c9b9a1d098d3d1249e5a03905bc.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads