Analysis
-
max time kernel
125s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 05:27
Behavioral task
behavioral1
Sample
880-55-0x0000000000180000-0x0000000000188000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
880-55-0x0000000000180000-0x0000000000188000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
880-55-0x0000000000180000-0x0000000000188000-memory.exe
-
Size
32KB
-
MD5
cf5442f206b6a13a388d975d78263e69
-
SHA1
521a8ad70e0fc649e1b846460e6988e5e4d09447
-
SHA256
2f5e487970cacf2050cd5b0f65e5000aef900aec92b91ee1de0742b59a4bcba8
-
SHA512
b8196f45d65a88cb050682f3827e3ee6f38a4b76d0c89a58186b5f9e5d4c040a0b5b6ded982a4eca25e3d099c522d756935949192f2db3164b27a7ddee9e3830
-
SSDEEP
384:X2/mDvD2lVzGOGXf9oDPlMNcLlb5sVKLyS5Ct:X2/mDvD2lVtgclMNEro
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
880-55-0x0000000000180000-0x0000000000188000-memory.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 880-55-0x0000000000180000-0x0000000000188000-memory.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 880-55-0x0000000000180000-0x0000000000188000-memory.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
880-55-0x0000000000180000-0x0000000000188000-memory.exedescription pid process Token: SeDebugPrivilege 1504 880-55-0x0000000000180000-0x0000000000188000-memory.exe