c15eba893b99a8fe3575459b33d5f535717d8b63e79e28078ef0b37edd3ff27a

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
22-09-2023 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c15eba893b99a8fe3575459b33d5f535717d8b63e79e28078ef0b37edd3ff27a.exe
Size

1.6MB
MD5

794f01fb4b17dbde63908cc076f67096
SHA1

039b079cf3420ae70156fbd2db2da3d8f2a95528
SHA256

c15eba893b99a8fe3575459b33d5f535717d8b63e79e28078ef0b37edd3ff27a
SHA512

dbd0c0911f35b30746c25c46fede6ee07bb2272c69c6d0d2b199b09d4fb3243bd90e2399295919cb9dee99867d25a7a1833716368c065039b720a346b7b520f2
SSDEEP

49152:uS21MxgPL6myGeQGe5PwXkz+9ujkDQ8kLPz6ZRre:fNx4JyzJybC9qk85Cj6

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c15eba893b99a8fe3575459b33d5f535717d8b63e79e28078ef0b37edd3ff27a.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2016	c15eba893b99a8fe3575459b33d5f535717d8b63e79e28078ef0b37edd3ff27a.exe
2016	c15eba893b99a8fe3575459b33d5f535717d8b63e79e28078ef0b37edd3ff27a.exe
2016	c15eba893b99a8fe3575459b33d5f535717d8b63e79e28078ef0b37edd3ff27a.exe

C:\Users\Admin\AppData\Local\Temp\c15eba893b99a8fe3575459b33d5f535717d8b63e79e28078ef0b37edd3ff27a.exe
"C:\Users\Admin\AppData\Local\Temp\c15eba893b99a8fe3575459b33d5f535717d8b63e79e28078ef0b37edd3ff27a.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-0-0x0000000000400000-0x000000000069B000-memory.dmp

Filesize
2.6MB

Download
memory/2016-1-0x0000000075950000-0x0000000075997000-memory.dmp

Filesize
284KB

Download
memory/2016-811-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-812-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-814-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-816-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-820-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-818-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-822-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-824-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-826-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-828-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-830-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-832-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-834-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-838-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-836-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-840-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-842-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-846-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-844-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-848-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-850-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-854-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-852-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-856-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-858-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-860-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-862-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-864-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-866-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-868-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-870-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-872-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-2547-0x00000000021E0000-0x0000000002361000-memory.dmp

Filesize
1.5MB

Download
memory/2016-8686-0x0000000002490000-0x00000000025A1000-memory.dmp

Filesize
1.1MB

Download
memory/2016-8689-0x0000000000400000-0x000000000069B000-memory.dmp

Filesize
2.6MB

Download