Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 13:24
Static task
static1
Behavioral task
behavioral1
Sample
37e34b38e471baf6a2e0be3f63bd51e8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
37e34b38e471baf6a2e0be3f63bd51e8.exe
Resource
win10v2004-20231215-en
General
-
Target
37e34b38e471baf6a2e0be3f63bd51e8.exe
-
Size
538KB
-
MD5
37e34b38e471baf6a2e0be3f63bd51e8
-
SHA1
e02172b1997455c8f474f725d1f1f2a80a091b69
-
SHA256
049415fe18d897450f7658042aa795df097bfbdb91b869092284951c1d8c7f68
-
SHA512
53e63567035c38aca8084b9ec1607e0d2c95e46328b09e9c31577a828beda918a8efdfff14286fd17125c0e9554d2d46964467ac281e3522dc44ada2c7cb5353
-
SSDEEP
12288:BRLRGoiTMwQrSgAH2XNLHIIL2gcb78Ki9iv5y:dkMwwSRILHIDdiOo
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 37e34b38e471baf6a2e0be3f63bd51e8.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 37e34b38e471baf6a2e0be3f63bd51e8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 37e34b38e471baf6a2e0be3f63bd51e8.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main 37e34b38e471baf6a2e0be3f63bd51e8.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 760 37e34b38e471baf6a2e0be3f63bd51e8.exe 760 37e34b38e471baf6a2e0be3f63bd51e8.exe 760 37e34b38e471baf6a2e0be3f63bd51e8.exe 760 37e34b38e471baf6a2e0be3f63bd51e8.exe 760 37e34b38e471baf6a2e0be3f63bd51e8.exe 760 37e34b38e471baf6a2e0be3f63bd51e8.exe 760 37e34b38e471baf6a2e0be3f63bd51e8.exe 760 37e34b38e471baf6a2e0be3f63bd51e8.exe 760 37e34b38e471baf6a2e0be3f63bd51e8.exe 760 37e34b38e471baf6a2e0be3f63bd51e8.exe 760 37e34b38e471baf6a2e0be3f63bd51e8.exe 760 37e34b38e471baf6a2e0be3f63bd51e8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37e34b38e471baf6a2e0be3f63bd51e8.exe"C:\Users\Admin\AppData\Local\Temp\37e34b38e471baf6a2e0be3f63bd51e8.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:760