8c787412f4a93cd8b6cb879b225271218473922e2d33824833b97147cf78f6c1

Analysis

max time kernel
121s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Park This Car Modded By Carlitos_560.exe
Size

2.9MB
MD5

0606e98a2e336eb27403919c2de65fa8
SHA1

c51812f959bc7057ee5150c6f2357e48cda7aa31
SHA256

8c787412f4a93cd8b6cb879b225271218473922e2d33824833b97147cf78f6c1
SHA512

540b80e25446d63dcb7876186140a51b71114ca681db9398ac000d9455f9910117ac0e0b1424e26d169fd1088165d95fa7c04741c654edcdfd865910d55036f3
SSDEEP

49152:PVHFXSFEmqiDqCbS1gickVsPTpuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuTuuua:PVHFXSCmqsSgfkVsNuuuuuuuuuuuuuuK

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Park This Car Modded By Carlitos_560.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Park This Car Modded By Carlitos_560.exe

C:\Users\Admin\AppData\Local\Temp\Park This Car Modded By Carlitos_560.exe
"C:\Users\Admin\AppData\Local\Temp\Park This Car Modded By Carlitos_560.exe"
1⤵
- Checks processor information in registry
PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...