42f76f37742103bd599a68ef508b515efeb9e9ffddbfdcc43eb552b70b2440e9

Analysis

max time kernel
135s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/05/2023, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Amazon Workspaces.exe
Size 3.1MB
Sample230512-lbbqaace65
SHA256 42f76f37742103bd599a68ef508b515efeb9e9ffddbfdcc43eb552b70b2440e9
MD5 3ef1892c1a5f1bb056871b7d7e5cd69a
SHA1 08a6ff5c2d443d2bf9facb2a458de2876328061b
SHA512 527172905cbb24923b294027d37f0e3de0190f442b45ba80a04a7640b222ee729558af36ae65c35e43dd2f4af36ea476ee2f94cd2d86f98536536a683e668a4d
SSDEEP 49152:dwG5dutV04/iT5W5pLoJ6qJNPhERaU+d:uGgJNVARX5ERaUc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Amazon Workspaces.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Amazon Workspaces.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1376	Amazon Workspaces.exe

C:\Users\Admin\AppData\Local\Temp\Amazon Workspaces.exe
"C:\Users\Admin\AppData\Local\Temp\Amazon Workspaces.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads