d9ee4dff746defa524781bf87e48399c07ab564dc4aaa75c07eb489d69eb4dfa

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9ee4dff746defa524781bf87e48399c07ab564dc4aaa75c07eb489d69eb4dfa.exe
Size

13.7MB
MD5

5e0379911e53c8d4bee77c43d43ef45e
SHA1

975e7e3c144c9c3b45e1946e150a6e5f7af4ebae
SHA256

d9ee4dff746defa524781bf87e48399c07ab564dc4aaa75c07eb489d69eb4dfa
SHA512

fa1967a92837e8f1863dce6051574122a57cf23a9e466f8e8970879428c1106927ce10ce5b029600af7eec209ddc69f4a177a3eac131b4c3e353e0f384e7f5ec
SSDEEP

98304:mVbRwiehD+M/FABeXEyNiGadTCRMA1iVztfe7mKaf6g6sknKBohTX1s1Cf:mrwiiDZ/EyNitdOyBfBWsEhTX12C

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	d9ee4dff746defa524781bf87e48399c07ab564dc4aaa75c07eb489d69eb4dfa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	d9ee4dff746defa524781bf87e48399c07ab564dc4aaa75c07eb489d69eb4dfa.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2392	d9ee4dff746defa524781bf87e48399c07ab564dc4aaa75c07eb489d69eb4dfa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	d9ee4dff746defa524781bf87e48399c07ab564dc4aaa75c07eb489d69eb4dfa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2392	d9ee4dff746defa524781bf87e48399c07ab564dc4aaa75c07eb489d69eb4dfa.exe
2392	d9ee4dff746defa524781bf87e48399c07ab564dc4aaa75c07eb489d69eb4dfa.exe

C:\Users\Admin\AppData\Local\Temp\d9ee4dff746defa524781bf87e48399c07ab564dc4aaa75c07eb489d69eb4dfa.exe
"C:\Users\Admin\AppData\Local\Temp\d9ee4dff746defa524781bf87e48399c07ab564dc4aaa75c07eb489d69eb4dfa.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads