Analysis
-
max time kernel
241s -
max time network
298s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 13:04
Static task
static1
Behavioral task
behavioral1
Sample
f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe
Resource
win10v2004-20230915-en
General
-
Target
f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe
-
Size
6.2MB
-
MD5
95bd09df6144f1e2bd33665f86deb927
-
SHA1
1273881657802b82a1ee9f4a8ea5d67581e1cede
-
SHA256
f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a
-
SHA512
625d95bc1623b5b309098c10b2bed4cda16d71f3d652a02be3321886a6b5a576e101031ea1329f4420f5ef3b9d129fe82a72b1b1937ebb5916329a3702d1bef5
-
SSDEEP
196608:ouQD74wo46Orhr30gHXwrBH+pEULsGorSvIVkq1Ua:ozD7F30gHXwWAFrSvIuMUa
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBIOSDate f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exedescription ioc process File opened (read-only) \??\S: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\G: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\H: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\I: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\M: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\Q: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\W: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\J: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\O: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\T: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\U: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\V: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\N: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\Y: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\Z: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\X: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\E: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\K: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\L: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\P: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe File opened (read-only) \??\R: f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exepid process 2716 f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe 2716 f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe 2716 f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBIOSDate f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe"C:\Users\Admin\AppData\Local\Temp\f48159606036b6ef4402965013d8a53608f81d2aadb0c29be9024b15da0fec2a.exe"1⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2716-0-0x0000000000400000-0x00000000007CC000-memory.dmpFilesize
3.8MB
-
memory/2716-1-0x0000000000400000-0x00000000007CC000-memory.dmpFilesize
3.8MB
-
memory/2716-3-0x0000000000240000-0x0000000000248000-memory.dmpFilesize
32KB
-
memory/2716-4-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2716-2-0x0000000000400000-0x00000000007CC000-memory.dmpFilesize
3.8MB
-
memory/2716-5-0x0000000000400000-0x00000000007CC000-memory.dmpFilesize
3.8MB
-
memory/2716-6-0x0000000000400000-0x00000000007CC000-memory.dmpFilesize
3.8MB
-
memory/2716-7-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2716-9-0x0000000000400000-0x00000000007CC000-memory.dmpFilesize
3.8MB
-
memory/2716-10-0x0000000000400000-0x00000000007CC000-memory.dmpFilesize
3.8MB