Analysis
- max time kernel
0s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
08/01/2024, 03:50
General
- Target 4a5da3a41402028f1ab9a5bf4f70d8d2.exe
- Size 1.2MB
- Sample240108-eebq5abfc6
- SHA256 c649fcbd206ba1ae9419c3a80aea1d9762ced8df1ad7386b03c962403a13656e
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a5da3a41402028f1ab9a5bf4f70d8d2.exe"C:\Users\Admin\AppData\Local\Temp\4a5da3a41402028f1ab9a5bf4f70d8d2.exe"1⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Enumerates system info in registry
-
C:\Program Files (x86)\CSec\cs.exe"C:\Program Files (x86)\CSec\cs.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4A5DA3~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/792-77-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-97-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-115-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-37-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-39-0x0000000002460000-0x0000000002461000-memory.dmp
memory/792-38-0x0000000002510000-0x0000000002511000-memory.dmp
memory/792-108-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-86-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-79-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-78-0x0000000002510000-0x0000000002511000-memory.dmp
memory/792-107-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-76-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-75-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-87-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-89-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-96-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-106-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-98-0x0000000000400000-0x0000000000704000-memory.dmp
memory/792-105-0x0000000000400000-0x0000000000704000-memory.dmp
memory/3196-2-0x0000000002940000-0x0000000002941000-memory.dmp
memory/3196-1-0x0000000000890000-0x0000000000891000-memory.dmp
memory/3196-44-0x0000000000400000-0x0000000000704000-memory.dmp
memory/3196-0-0x0000000000400000-0x0000000000704000-memory.dmp