42af92e5be37c1daddda7672372a39ccebb24d31d2ea65bec2a74dfbc3a4e82c

Analysis

max time kernel
144s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2024 07:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

403990c6cbb042f7c1f5e57177272f81.exe
Size

1.3MB
MD5

403990c6cbb042f7c1f5e57177272f81
SHA1

ab9ef44ed7b93ecf7b6c43f23d75a3f2dc9d5a1b
SHA256

42af92e5be37c1daddda7672372a39ccebb24d31d2ea65bec2a74dfbc3a4e82c
SHA512

cb1adffb69f4ff6a62257325504cebc41d22f41910a41eae9c04ec5327da9f58fb652e79b87f580c7ac6f81f27cf2fba77b4fc3947b27dd59ae376f2d7c57ee5
SSDEEP

24576:hW5Df+qq6n4nP3P/oldSC+v18pqOxtKBsYOkP7Jz5I4MZ+xnF84gv41bb1tnKx4/:h9tvMqkm15SnDF5IPsmAjinh

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3976	403990c6cbb042f7c1f5e57177272f81.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	403990c6cbb042f7c1f5e57177272f81.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	403990c6cbb042f7c1f5e57177272f81.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	403990c6cbb042f7c1f5e57177272f81.exe
File created	C:\Windows\assembly\Desktop.ini	403990c6cbb042f7c1f5e57177272f81.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	403990c6cbb042f7c1f5e57177272f81.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	2484	dw20.exe
Token: SeBackupPrivilege	2484	dw20.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 2484	3976	403990c6cbb042f7c1f5e57177272f81.exe	92
PID 3976 wrote to memory of 2484	3976	403990c6cbb042f7c1f5e57177272f81.exe	92

C:\Users\Admin\AppData\Local\Temp\403990c6cbb042f7c1f5e57177272f81.exe
"C:\Users\Admin\AppData\Local\Temp\403990c6cbb042f7c1f5e57177272f81.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 876
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

Filesize
39KB

MD5
d80d1b6d9a6d5986fa47f6f8487030e1

SHA1
8f5773bf9eca43b079c1766b2e9f44cc90bd9215

SHA256
446128f1712da8064d0197376184315cb529ed26ed9122f7b171bb208e22c0c3

SHA512
9fcf0105c2c9ee81c526d41633d93579bb8e2837989d77fb4a6523440415ec2d7fa46ac9ae4e55ecebd99126837817ac308cc079475de02667b21727a43d74cc

Download Submit
memory/3976-14-0x0000000000FF0000-0x0000000001000000-memory.dmp

Filesize
64KB

Download
memory/3976-1-0x000000001B780000-0x000000001B78C000-memory.dmp

Filesize
48KB

Download
memory/3976-2-0x00007FF958DF0000-0x00007FF959791000-memory.dmp

Filesize
9.6MB

Download
memory/3976-3-0x0000000000FF0000-0x0000000001000000-memory.dmp

Filesize
64KB

Download
memory/3976-0-0x00007FF958DF0000-0x00007FF959791000-memory.dmp

Filesize
9.6MB

Download
memory/3976-18-0x000000001BA30000-0x000000001BA8C000-memory.dmp

Filesize
368KB

Download
memory/3976-19-0x000000001C010000-0x000000001C4DE000-memory.dmp

Filesize
4.8MB

Download
memory/3976-21-0x000000001B8E0000-0x000000001B92E000-memory.dmp

Filesize
312KB

Download
memory/3976-20-0x000000001C4E0000-0x000000001C57C000-memory.dmp

Filesize
624KB

Download
memory/3976-15-0x0000000001170000-0x000000000117E000-memory.dmp

Filesize
56KB

Download
memory/3976-28-0x00007FF958DF0000-0x00007FF959791000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads