Analysis
-
max time kernel
2s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 20:51
Static task
static1
Behavioral task
behavioral1
Sample
3c4ca1145f8e60c088ff40bc5bf65a8a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3c4ca1145f8e60c088ff40bc5bf65a8a.exe
Resource
win10v2004-20231222-en
General
-
Target
3c4ca1145f8e60c088ff40bc5bf65a8a.exe
-
Size
521KB
-
MD5
3c4ca1145f8e60c088ff40bc5bf65a8a
-
SHA1
8dcdfab7d73fb1e15c5afe189defc568fb0bc532
-
SHA256
06453573fd1c371b1fff60ba4eaef9630019ce390e4959c7e8f293c237796eeb
-
SHA512
f4ebd560ef4d65dc78f0b0cd566887d1f8a21284f7ed89f21d5e7bce1c2cbcd302b14a26a1592e1851a75e6ae472e356a2b3fca6d008c6bdeec88fbee9621876
-
SSDEEP
12288:qL7GuyK/RFuWzlbyCCVUVrvet55WaVwzOFd2RnKLbNaQ/CX2xVkN:mXyidzJynUVc5YaiOGRKXNCuGN
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3c4ca1145f8e60c088ff40bc5bf65a8a.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 3c4ca1145f8e60c088ff40bc5bf65a8a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 3c4ca1145f8e60c088ff40bc5bf65a8a.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2864 3c4ca1145f8e60c088ff40bc5bf65a8a.exe 2864 3c4ca1145f8e60c088ff40bc5bf65a8a.exe 2864 3c4ca1145f8e60c088ff40bc5bf65a8a.exe 2864 3c4ca1145f8e60c088ff40bc5bf65a8a.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06