8aa7a3eb64942833fdeae402d26bd9ef3281da4dfd30c26a34c4f5a750343c7c

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2023 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea27b8767226bf2f82292f2264087012.exe
Size

1.9MB
MD5

ea27b8767226bf2f82292f2264087012
SHA1

d475393db8829c9677102e5e4a38da6848c19796
SHA256

8aa7a3eb64942833fdeae402d26bd9ef3281da4dfd30c26a34c4f5a750343c7c
SHA512

d1adbdb6ee64532ce7594d19853c94c3f271753f02064d37a6d924fef3e80c4be932a35bd4b5ee1293b7e7279a9db8a766d2028b85973cfe6a38350a6cae50db
SSDEEP

49152:Px8TT3n110bbsSU/vM5hMrD+d8oQ+9XTNvUHM4AOyD:2TTX11a23MU+vD9X

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4552	ea27b8767226bf2f82292f2264087012.tmp

Loads dropped DLL 5 IoCs

pid	Process
4552	ea27b8767226bf2f82292f2264087012.tmp
4552	ea27b8767226bf2f82292f2264087012.tmp
4552	ea27b8767226bf2f82292f2264087012.tmp
4552	ea27b8767226bf2f82292f2264087012.tmp
4552	ea27b8767226bf2f82292f2264087012.tmp

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ea27b8767226bf2f82292f2264087012.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ea27b8767226bf2f82292f2264087012.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ea27b8767226bf2f82292f2264087012.tmp
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor	ea27b8767226bf2f82292f2264087012.tmp
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	ea27b8767226bf2f82292f2264087012.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2056	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4552	2772	ea27b8767226bf2f82292f2264087012.exe	89
PID 2772 wrote to memory of 4552	2772	ea27b8767226bf2f82292f2264087012.exe	89
PID 2772 wrote to memory of 4552	2772	ea27b8767226bf2f82292f2264087012.exe	89

C:\Users\Admin\AppData\Local\Temp\ea27b8767226bf2f82292f2264087012.exe
"C:\Users\Admin\AppData\Local\Temp\ea27b8767226bf2f82292f2264087012.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\is-RQCHS.tmp\ea27b8767226bf2f82292f2264087012.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RQCHS.tmp\ea27b8767226bf2f82292f2264087012.tmp" /SL5="$170042,1519113,152064,C:\Users\Admin\AppData\Local\Temp\ea27b8767226bf2f82292f2264087012.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4552

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-9QBSO.tmp\CheckBox.png

Filesize
7KB

MD5
abd301b0263b0e0cebdd71e4855ac7d3

SHA1
1e8480c3f3b47a5daa7cb1183b6a7a49998cda6e

SHA256
aff003e75bbf410ed2f7ca8728afe01ab4a517536647ad20109d00c4adf570d5

SHA512
b5abb188bd23d7fc2e3253a5639cc3eba6d21774dba55b43395cf84ddb49fe707ad54dc0a7f157e6b0804c1662d9c4cb4bef2787aafb194ea73fbebd1a63bb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9QBSO.tmp\WizardImage.jpg

Filesize
62KB

MD5
b91658597f15d7f689c86f5a2e7824bd

SHA1
00da609aa0b39140b767a3bc2644433d64edbd71

SHA256
b3cda6ab45ad5aa6a0a5f700d2c8987b3c1c1ebda63165d9bd5a566b24dcbd84

SHA512
00b287fb14b947edf4b16d52243e9a992595d8894e83d8590473103d1b54a4670b323db13c4f78234617c44f905baf517e68fcceaad313f3ea7cd44cf036daea

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9QBSO.tmp\botva2.dll

Filesize
32KB

MD5
295832fa6400cb3407cfe84b06785531

SHA1
7068910c2e0ea7f4535c770517e29d9c2d2ee77b

SHA256
13e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784

SHA512
50516f9761efd14641f65bd773cfdd50c4ab0de977e094ba9227796dc319d9330321c7914243fc7dc04b5716752395f8dac8ccdfdb98ba7e5f5c1172408ce57b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9QBSO.tmp\botva2.dll

Filesize
32KB

MD5
295832fa6400cb3407cfe84b06785531

SHA1
7068910c2e0ea7f4535c770517e29d9c2d2ee77b

SHA256
13e372c4d843603096f33603915c3f25d0e0d4475001c33ce5263bfcd1760784

SHA512
50516f9761efd14641f65bd773cfdd50c4ab0de977e094ba9227796dc319d9330321c7914243fc7dc04b5716752395f8dac8ccdfdb98ba7e5f5c1172408ce57b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9QBSO.tmp\button.png

Filesize
12KB

MD5
51af4120d6d22b1126cc87a5143740ef

SHA1
1cb4e91e765537a72c9628056d29fbd6a7ce515c

SHA256
c74fed62141f7e666379a0b00d5b39c86975332cf08151cbe8cab88eff2c393c

SHA512
2595be954684ca34bc9284337524a5191c72fbea46b59555a5113ed8404a1e7ab6c2aa0f5a975f832cccdd8934ff1140c679ecd940f31cc14b4c3a362a225cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9QBSO.tmp\get_hw_caps.dll

Filesize
76KB

MD5
2e35d2894df3b691dbd8e0d4f4c84efc

SHA1
d0fc14963e397d185e9f2d7dea1d07bc6308d5b9

SHA256
869079ba362cbc560d673db290248ec2aa075a74f22a82d90621f1118f8e1c4d

SHA512
29ba662ab2e77aef0547ff76213a1b6ef52be27a446923790a27cf8b69377621048387dbb9f22001b6d15837dddada84c7350614ec9622258319658822705f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9QBSO.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9QBSO.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RQCHS.tmp\ea27b8767226bf2f82292f2264087012.tmp

Filesize
1.4MB

MD5
7300211c571951be86be6c6f8cdfc09d

SHA1
5464e16689003406513c7677b3d970f673551d18

SHA256
e77c3184d90f6e7a1276bb8389aba06296be97deb2e8a3433ca9a537538696da

SHA512
9c340edcd63c87565a9de26892d2e83647798583cc942bf608b54e86b8fd36bc2ad64421241b88f0a0682e7c006a5af712e62d3231ca5a81264d8b1a1905ebb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RQCHS.tmp\ea27b8767226bf2f82292f2264087012.tmp

Filesize
1.4MB

MD5
7300211c571951be86be6c6f8cdfc09d

SHA1
5464e16689003406513c7677b3d970f673551d18

SHA256
e77c3184d90f6e7a1276bb8389aba06296be97deb2e8a3433ca9a537538696da

SHA512
9c340edcd63c87565a9de26892d2e83647798583cc942bf608b54e86b8fd36bc2ad64421241b88f0a0682e7c006a5af712e62d3231ca5a81264d8b1a1905ebb4

Download Submit
memory/2056-148-0x000001653E240000-0x000001653E250000-memory.dmp

Filesize
64KB

Download
memory/2056-164-0x000001653E340000-0x000001653E350000-memory.dmp

Filesize
64KB

Download
memory/2772-110-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2772-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4552-76-0x0000000005E70000-0x0000000005E85000-memory.dmp

Filesize
84KB

Download
memory/4552-112-0x0000000000400000-0x000000000057B000-memory.dmp

Filesize
1.5MB

Download
memory/4552-114-0x0000000005E70000-0x0000000005E85000-memory.dmp

Filesize
84KB

Download
memory/4552-113-0x0000000003480000-0x000000000348D000-memory.dmp

Filesize
52KB

Download
memory/4552-115-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/4552-122-0x0000000003480000-0x000000000348D000-memory.dmp

Filesize
52KB

Download
memory/4552-123-0x0000000005E70000-0x0000000005E85000-memory.dmp

Filesize
84KB

Download
memory/4552-34-0x0000000003480000-0x000000000348D000-memory.dmp

Filesize
52KB

Download
memory/4552-6-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download