e1754f93f15c5d36ab0bea9baa22ba8108170f8f641f67bdab449a707572bd63

General

Target

41534447f7279880c73f606a4a3b469c.exe
Size

1.6MB
MD5

41534447f7279880c73f606a4a3b469c
SHA1

446aa35ff703995042df4ccb6a6a3240f31a99d8
SHA256

e1754f93f15c5d36ab0bea9baa22ba8108170f8f641f67bdab449a707572bd63
SHA512

40b06b65f9f4fb5eb4bbd8b59de79c73d4a8ab18a288b97b8207a017db8e917a036575840567505a35c968714a0dc7825784a73e5cff3f70c0ed938bd6d52fca
SSDEEP

49152:Z9pkT//LEkPUf3ywg/UsbjC/uXSSKepjeY/Lky:ZALrUf3ywgssjC/uXVjeA

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	41534447f7279880c73f606a4a3b469c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	41534447f7279880c73f606a4a3b469c.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\InprocServer32\ThreadingModel = "Apartment"	41534447f7279880c73f606a4a3b469c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\TypeLib\ = "{B0EDF154-910A-11D2-B632-00C04F79498E}"	41534447f7279880c73f606a4a3b469c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\InprocServer32\ = "C:\\Windows\\SysWOW64\\msvidctl.dll"	41534447f7279880c73f606a4a3b469c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\Programmable	41534447f7279880c73f606a4a3b469c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\InprocServer32	41534447f7279880c73f606a4a3b469c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\ProgID	41534447f7279880c73f606a4a3b469c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\ProgID\ = "MSVidCtl.MSVidXDS.1"	41534447f7279880c73f606a4a3b469c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\TypeLib	41534447f7279880c73f606a4a3b469c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\Version	41534447f7279880c73f606a4a3b469c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}	41534447f7279880c73f606a4a3b469c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\ = "XDS Feature Segment"	41534447f7279880c73f606a4a3b469c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	41534447f7279880c73f606a4a3b469c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\Version\ = "1.0"	41534447f7279880c73f606a4a3b469c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\VersionIndependentProgID	41534447f7279880c73f606a4a3b469c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\Implemented Categories	41534447f7279880c73f606a4a3b469c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{165CEC4B-0154-C08B-E0B3-58CDC5653271}\VersionIndependentProgID\ = "MSVidCtl.MSVidXDS"	41534447f7279880c73f606a4a3b469c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2968	41534447f7279880c73f606a4a3b469c.exe
Token: SeIncBasePriorityPrivilege	2968	41534447f7279880c73f606a4a3b469c.exe

C:\Users\Admin\AppData\Local\Temp\41534447f7279880c73f606a4a3b469c.exe
"C:\Users\Admin\AppData\Local\Temp\41534447f7279880c73f606a4a3b469c.exe"
1⤵
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2968-0-0x0000000000400000-0x00000000005E9000-memory.dmp

Filesize
1.9MB

Download
memory/2968-1-0x0000000001EB0000-0x0000000001FB3000-memory.dmp

Filesize
1.0MB

Download
memory/2968-8-0x0000000001EB0000-0x0000000001FB3000-memory.dmp

Filesize
1.0MB

Download
memory/2968-7-0x0000000001EB0000-0x0000000001FB3000-memory.dmp

Filesize
1.0MB

Download
memory/2968-10-0x0000000001EB0000-0x0000000001FB3000-memory.dmp

Filesize
1.0MB

Download
memory/2968-11-0x0000000001EB0000-0x0000000001FB3000-memory.dmp

Filesize
1.0MB

Download
memory/2968-14-0x0000000000400000-0x00000000005E9000-memory.dmp

Filesize
1.9MB

Download
memory/2968-16-0x0000000000400000-0x00000000005E9000-memory.dmp

Filesize
1.9MB

Download
memory/2968-15-0x0000000000400000-0x00000000005E9000-memory.dmp

Filesize
1.9MB

Download
memory/2968-17-0x0000000001EB0000-0x0000000001FB3000-memory.dmp

Filesize
1.0MB

Download
memory/2968-19-0x0000000000400000-0x00000000005E9000-memory.dmp

Filesize
1.9MB

Download
memory/2968-18-0x0000000001EB0000-0x0000000001FB3000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing