818a80e3132590610cb48112b32ac5468a1be9342aad1a56ec23e2a67b5cf40a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/09/2023, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

818a80e3132590610cb48112b32ac5468a1be9342aad1a56ec23e2a67b5cf40a.exe
Size

7.0MB
MD5

38c7c204fbcb9b88a4dcfe2effefdcce
SHA1

d0dd27a1485a0cd62712c9fe6bd98727c40054e9
SHA256

818a80e3132590610cb48112b32ac5468a1be9342aad1a56ec23e2a67b5cf40a
SHA512

d53d884ed00793e959c59cf56f233d4d060e56c4ceb38dbf826dfa6460508ae15cd4ccfb103902d29bf02ced6e64906d3d0be1df3633f1b9d57a3eba1e82fa83
SSDEEP

196608:WwfCJxtislFms3M3Xgzif66Hq2DfEgKwqzOl:iJxtJFm6Mdf66H5fEgKPql

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	818a80e3132590610cb48112b32ac5468a1be9342aad1a56ec23e2a67b5cf40a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	818a80e3132590610cb48112b32ac5468a1be9342aad1a56ec23e2a67b5cf40a.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	818a80e3132590610cb48112b32ac5468a1be9342aad1a56ec23e2a67b5cf40a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	818a80e3132590610cb48112b32ac5468a1be9342aad1a56ec23e2a67b5cf40a.exe

C:\Users\Admin\AppData\Local\Temp\818a80e3132590610cb48112b32ac5468a1be9342aad1a56ec23e2a67b5cf40a.exe
"C:\Users\Admin\AppData\Local\Temp\818a80e3132590610cb48112b32ac5468a1be9342aad1a56ec23e2a67b5cf40a.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Sentinel\SuperDog\1a658531-e287-9aeb-2497-7f53c52459af\.434e4631\.9eaaeeba

Filesize
120B

MD5
b67712135d8d2143e443698ee78f00ab

SHA1
c470d74e25ba2a5f9f1a87663f6ebb1867fef14f

SHA256
b43e4a0e8ccf2a0f75612ffc3be18336bff93f9101fffecc52e27eacd5c181e4

SHA512
2a7434e073d2ef894699e195d9a536a39c8942f8af68e27463772f7c2fb9c4c2987b65701315ddfcfcdb6d3aca78790bdd31b72ac370cbfa6e7964f2d30bfaef

Download Submit
memory/2444-0-0x0000000000F30000-0x00000000022B8000-memory.dmp

Filesize
19.5MB

Download
memory/2444-13-0x0000000000F30000-0x00000000022B8000-memory.dmp

Filesize
19.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads