6122dfa6ce8b8da8177dafb307d3719059610f8001ae3849f27e27e4814b6b21

Analysis

max time kernel
439s
max time network
453s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2023 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Crack Setup/bin/File.dll
Size

38.5MB
MD5

aecad1828f15b8c361e2b0a74296f4f7
SHA1

4d2d4cff30a3e0af951dfb3af8832a7b2ef511f0
SHA256

e1d536f4acfb54fc62ab7bbb5fe0e4153e8674c80d8d783cad78c52676a134cb
SHA512

3ded40022ae4eac92aafc554855ab58e2b06745bb56eccbacaef102d57b808f0724a60e6605d82fc7799a07f5664db2c87086908798d65b92168ff93d0e2b3dc
SSDEEP

98304:MVF638GAYLT6hu9EKIBqn2gWrCjWHMntBxF1rJ68REQe6rYxYGVD6AZa0EntxqD:rgYLT6huutDgTpB/BJ6ljxFDoYD

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crack Setup\bin\File.dll",#1
1⤵
PID:4904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads