b6d6a1acf54cd49e1b46448b43212fd3574ad3e406e1bee95630300ef5425ceb

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b6d6a1acf54cd49e1b46448b43212fd3574ad3e406e1bee95630300ef5425ceb.exe
Size

170KB
MD5

34ed23e4e88557dc42ccef78c6b84338
SHA1

84402302230712196a76a791fbdc59211d76571a
SHA256

b6d6a1acf54cd49e1b46448b43212fd3574ad3e406e1bee95630300ef5425ceb
SHA512

76e7070de0c21d5d025fa67bb1449b8ee28a42672ec307ed5367a8fc3a290aff6358458b0438011380b1028d448998c15340259a63729ec59556afcda4d89842
SSDEEP

3072:KYRkrHgZf6Yb0yHVq6VqVMe7ws/YB1ySYDJXYr2eleC9D:KVrHgzb0yHVqlb5YZYDRYblV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1916	dipzew.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dipzew.exe	b6d6a1acf54cd49e1b46448b43212fd3574ad3e406e1bee95630300ef5425ceb.exe
File opened for modification	C:\Windows\SysWOW64\dipzew.exe	b6d6a1acf54cd49e1b46448b43212fd3574ad3e406e1bee95630300ef5425ceb.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dipzew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dipzew.exe

C:\Users\Admin\AppData\Local\Temp\b6d6a1acf54cd49e1b46448b43212fd3574ad3e406e1bee95630300ef5425ceb.exe
"C:\Users\Admin\AppData\Local\Temp\b6d6a1acf54cd49e1b46448b43212fd3574ad3e406e1bee95630300ef5425ceb.exe"
1⤵
- Drops file in System32 directory
PID:1604

C:\Windows\SysWOW64\dipzew.exe
C:\Windows\SysWOW64\dipzew.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dipzew.exe

Filesize
170KB

MD5
34ed23e4e88557dc42ccef78c6b84338

SHA1
84402302230712196a76a791fbdc59211d76571a

SHA256
b6d6a1acf54cd49e1b46448b43212fd3574ad3e406e1bee95630300ef5425ceb

SHA512
76e7070de0c21d5d025fa67bb1449b8ee28a42672ec307ed5367a8fc3a290aff6358458b0438011380b1028d448998c15340259a63729ec59556afcda4d89842

Download Submit
C:\Windows\SysWOW64\dipzew.exe

Filesize
170KB

MD5
34ed23e4e88557dc42ccef78c6b84338

SHA1
84402302230712196a76a791fbdc59211d76571a

SHA256
b6d6a1acf54cd49e1b46448b43212fd3574ad3e406e1bee95630300ef5425ceb

SHA512
76e7070de0c21d5d025fa67bb1449b8ee28a42672ec307ed5367a8fc3a290aff6358458b0438011380b1028d448998c15340259a63729ec59556afcda4d89842

Download Submit