7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/04/2023, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
Size

2.4MB
MD5

2e3ac1140254a256fd4e34768cb67a6e
SHA1

1fc2a98fa4d61dc8639a30382a92c10782f0e7f2
SHA256

7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37
SHA512

225c4e4057a3115c473fd7b76802349bc4dafcd4fb7ed42e4eaf8b650c9b5f5b8fa04d9a54113991923d1c84b5513ef6fa201400e6dfb925122a507482dc34a3
SSDEEP

49152:flYLIm/LsNN/KSr4vFCyLjTRwulp4/IJg8yn6Uc9V+szVO:d+GDr4vF9HpdUggsU

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1060-55-0x0000000140000000-0x00000001402F5000-memory.dmp	autoit_exe
behavioral1/memory/1060-56-0x0000000140000000-0x00000001402F5000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs

pid	Process
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
1060	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe

C:\Users\Admin\AppData\Local\Temp\7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe
"C:\Users\Admin\AppData\Local\Temp\7e306110ec9c01320b2356d94010ed581e77b6014d80aacba441b4bd09ec7e37.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-54-0x0000000140000000-0x00000001402F5000-memory.dmp

Filesize
3.0MB

Download
memory/1060-55-0x0000000140000000-0x00000001402F5000-memory.dmp

Filesize
3.0MB

Download
memory/1060-56-0x0000000140000000-0x00000001402F5000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads