Analysis
-
max time kernel
164s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 06:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b137ecad3580d387398c051b88834b9.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b137ecad3580d387398c051b88834b9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
0b137ecad3580d387398c051b88834b9.exe
-
Size
696KB
-
MD5
0b137ecad3580d387398c051b88834b9
-
SHA1
67f8e74147bed92eaa07786b2b22d47896438bc9
-
SHA256
786f22f49040e4397ab83d7bc6367db9b956abdca141d85756d7bfcaa1707ac9
-
SHA512
ecdbe87ceb4b18668e3450a6cdf4b53ba03a1b5a13daffc0dac4820b7da9f69d4203e2d9067b4e85b0641acd37bc0db3c7e136f66bd283091808d24967ff11d0
-
SSDEEP
12288:tjvZNCKUReWAyoca/fiOCIwW8X+0mhVOepKBBZsQ0x6WiSCXcF/:p3UnAAa/qOGW8X+04ppVx/vp
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0b137ecad3580d387398c051b88834b9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 0b137ecad3580d387398c051b88834b9.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 0b137ecad3580d387398c051b88834b9.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\ = "TerminalEvents" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655} 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655} 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\ = "OleTerminalDisp" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\TypeLib\ = "{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\ = "TerminalDisp" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287} 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0\FLAGS 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0\HELPDIR 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\ = "OleTerminalDisp" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\TypeLib\ = "{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\ = "TerminalDisp" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\TypeLib\ = "{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FADB651D-633B-482B-B492-7C6301C546E9}\InprocHandler32 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.Terminal 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FADB651D-633B-482B-B492-7C6301C546E9}\ProgID\ = "CommunicationTerminal.TerminalDispatch" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FADB651D-633B-482B-B492-7C6301C546E9}\InprocHandler32\ = "ole32.dll" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655} 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\TypeLib\ = "{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FADB651D-633B-482B-B492-7C6301C546E9}\ProgID 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655}\LocalServer32 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0\FLAGS\ = "0" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FADB651D-633B-482B-B492-7C6301C546E9} 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.TerminalDispatch\CLSID 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\ = "OleTerminalEvents" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21} 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.TerminalDispatch 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.Terminal\ = "CommunicationTerminal.Terminal" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655} 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\TypeLib\ = "{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FADB651D-633B-482B-B492-7C6301C546E9}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0B137E~1.EXE" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0\0 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0\0\win32 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\TypeLib\ = "{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.TerminalDispatch\CLSID\ = "{FADB651D-633B-482B-B492-7C6301C546E9}" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655}\ = "CommunicationTerminal.Terminal" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\ = "TerminalEvents" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.TerminalDispatch\ = "CommunicationTerminal.TerminalDispatch" 0b137ecad3580d387398c051b88834b9.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 3908 0b137ecad3580d387398c051b88834b9.exe Token: SeIncBasePriorityPrivilege 3908 0b137ecad3580d387398c051b88834b9.exe Token: 33 3908 0b137ecad3580d387398c051b88834b9.exe Token: SeIncBasePriorityPrivilege 3908 0b137ecad3580d387398c051b88834b9.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3908 0b137ecad3580d387398c051b88834b9.exe 3908 0b137ecad3580d387398c051b88834b9.exe 3908 0b137ecad3580d387398c051b88834b9.exe 3908 0b137ecad3580d387398c051b88834b9.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91 PID 4860 wrote to memory of 3908 4860 0b137ecad3580d387398c051b88834b9.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b137ecad3580d387398c051b88834b9.exe"C:\Users\Admin\AppData\Local\Temp\0b137ecad3580d387398c051b88834b9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\0b137ecad3580d387398c051b88834b9.exe"C:\Users\Admin\AppData\Local\Temp\0b137ecad3580d387398c051b88834b9.exe"2⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3908
-