6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d

Analysis

max time kernel
163s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
Size

9.3MB
MD5

b340d4d00119ff6f8468a13429decb04
SHA1

9f383b3a5d9d5e556e5468f5af2c1dff33d6f8dc
SHA256

6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d
SHA512

3372d2c279b2775cbb1be730d4e4eb169d019ab0fe17aa907e66335d198a11775cbace6d16810ef89324b68f507d16370bdda1efb6cef1b18a852d35d6d14ea8
SSDEEP

196608:trvIOGT0uaarBrFtDH5hTB5IaXSu9FyAxTUy79IPGuucF:NW07aBbTToaXSufyAxTUy79IPfucF

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBIOSDate	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\I:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\J:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\Q:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\S:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\T:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\Y:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\K:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\M:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\N:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\P:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\R:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\Z:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\V:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\W:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\X:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\E:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\G:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\L:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\O:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
File opened (read-only)	\??\U:	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2248	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
2248	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
2248	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBIOSDate	6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe

C:\Users\Admin\AppData\Local\Temp\6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe
"C:\Users\Admin\AppData\Local\Temp\6d1702087b7aeddad67dfcc17824a79767078a7c8a9ce8a67c848ce8e27a159d.exe"
1⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-0-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/2248-1-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/2248-2-0x0000000000940000-0x0000000000948000-memory.dmp

Filesize
32KB

Download
memory/2248-3-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/2248-4-0x0000000000400000-0x00000000007CB000-memory.dmp

Filesize
3.8MB

Download
memory/2248-6-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads