42f76f37742103bd599a68ef508b515efeb9e9ffddbfdcc43eb552b70b2440e9

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2023, 09:21

Target
Amazon Workspaces.exe
Size 3.1MB
Sample230512-lbbqaace65
SHA256 42f76f37742103bd599a68ef508b515efeb9e9ffddbfdcc43eb552b70b2440e9
MD5 3ef1892c1a5f1bb056871b7d7e5cd69a
SHA1 08a6ff5c2d443d2bf9facb2a458de2876328061b
SHA512 527172905cbb24923b294027d37f0e3de0190f442b45ba80a04a7640b222ee729558af36ae65c35e43dd2f4af36ea476ee2f94cd2d86f98536536a683e668a4d
SSDEEP 49152:dwG5dutV04/iT5W5pLoJ6qJNPhERaU+d:uGgJNVARX5ERaUc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Amazon Workspaces.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Amazon Workspaces.exe

C:\Users\Admin\AppData\Local\Temp\Amazon Workspaces.exe
"C:\Users\Admin\AppData\Local\Temp\Amazon Workspaces.exe"
1⤵
- Enumerates system info in registry
PID:3000

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact