f54ca9b6dd02744c4ee5668b2635cc8acbe8e7017794e9611db5ad7931f19c0b

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2023, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f54ca9b6dd02744c4ee5668b2635cc8acbe8e7017794e9611db5ad7931f19c0b.exe
Size

725KB
MD5

5b802b7107c8d74a074d80263b84a5ab
SHA1

119100084cac2c28fae5170007757b919cb87c13
SHA256

f54ca9b6dd02744c4ee5668b2635cc8acbe8e7017794e9611db5ad7931f19c0b
SHA512

dfa93b150bf3d49bae476158adf7568b28974e2f7edd9d448544c2de391dde88084408c5ee81329eed76e1fcb64525f9e096da0875a3416be96e09dc93c5c185
SSDEEP

12288:PYmzPYa2nSib+9U2Uey4ckBPLTMnBYol/lqapsl4hF10BpI7RNhjTxp6KwVfGp2Q:gbaEBU/meBjTMhaBGhF1OpItx2Ru2quq

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	f54ca9b6dd02744c4ee5668b2635cc8acbe8e7017794e9611db5ad7931f19c0b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	f54ca9b6dd02744c4ee5668b2635cc8acbe8e7017794e9611db5ad7931f19c0b.exe

C:\Users\Admin\AppData\Local\Temp\f54ca9b6dd02744c4ee5668b2635cc8acbe8e7017794e9611db5ad7931f19c0b.exe
"C:\Users\Admin\AppData\Local\Temp\f54ca9b6dd02744c4ee5668b2635cc8acbe8e7017794e9611db5ad7931f19c0b.exe"
1⤵
- Checks processor information in registry
PID:2816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2816-133-0x0000000000400000-0x0000000000651000-memory.dmp

Filesize
2.3MB

Download
memory/2816-134-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/2816-135-0x0000000000400000-0x0000000000651000-memory.dmp

Filesize
2.3MB

Download