57c9ccf5d6bfbac4b9a455f8d0b0183ed1581f38088b1f8cdb91e41986e80406

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6e38d791e02945b8b41ca748d81f2f1.exe
Size

1.2MB
MD5

f6e38d791e02945b8b41ca748d81f2f1
SHA1

921e80ea398fd763a04f5755eb52a246fb3dab49
SHA256

57c9ccf5d6bfbac4b9a455f8d0b0183ed1581f38088b1f8cdb91e41986e80406
SHA512

240784d2ef74941ecb50efa874429dbdf78b31e3eecd0db5ed1b3a358b5225aa2a5d107ec6e4ca92336fd27b88c542a8d35e3187c6313c8b06150b40fca917d6
SSDEEP

24576:gz5px7lbeJfYVcisyzErAjehjV6KLbS0PdL2Gwk0s0nQT:gz5pJl/rz/jeZVFbTdL/N050

Score

7^/10

upx

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f6e38d791e02945b8b41ca748d81f2f1.exe

Loads dropped DLL 1 IoCs

pid	Process
920	f6e38d791e02945b8b41ca748d81f2f1.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/920-15-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/920-20-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/920-21-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/920-18-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/920-17-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/920-23-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
988	920	WerFault.exe	16
4952	920	WerFault.exe	16

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
920	f6e38d791e02945b8b41ca748d81f2f1.exe
920	f6e38d791e02945b8b41ca748d81f2f1.exe
920	f6e38d791e02945b8b41ca748d81f2f1.exe

C:\Users\Admin\AppData\Local\Temp\f6e38d791e02945b8b41ca748d81f2f1.exe
"C:\Users\Admin\AppData\Local\Temp\f6e38d791e02945b8b41ca748d81f2f1.exe"
1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 768
  2⤵
  - Program crash
  PID:988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 788
  2⤵
  - Program crash
  PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 920 -ip 920
1⤵
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 920 -ip 920
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-0-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/920-3-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/920-4-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/920-6-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/920-7-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/920-2-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/920-1-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/920-15-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/920-20-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/920-21-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/920-18-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/920-17-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/920-23-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/920-22-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download