c1bcecae17d0cbc368de2bda44bcdf9ce432125b13b7f5c0969b6b0f68d131cb

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52cbc7e32eb06c1733968792f83c3126.exe
Size

246KB
MD5

52cbc7e32eb06c1733968792f83c3126
SHA1

d54d613adf041f686c9cf7fe46b888214b141d1b
SHA256

c1bcecae17d0cbc368de2bda44bcdf9ce432125b13b7f5c0969b6b0f68d131cb
SHA512

9f2dc0377c5a1f8a08ee4b3471595a038b52d68fbaf8a0f0ddf47554206cfaf37a87effa488acaf740c78f38590e77c81a969cafcc3d629a9f64df5911e3749a
SSDEEP

6144:VauE1BXgF6GFI0uNTHPewM5pb5dcAyQnPS+0v8d:VuQF6ANuU5pb5SunqE

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ra_ds.log	52cbc7e32eb06c1733968792f83c3126.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	52cbc7e32eb06c1733968792f83c3126.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	52cbc7e32eb06c1733968792f83c3126.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	52cbc7e32eb06c1733968792f83c3126.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	52cbc7e32eb06c1733968792f83c3126.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	52cbc7e32eb06c1733968792f83c3126.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe
2484	52cbc7e32eb06c1733968792f83c3126.exe

C:\Users\Admin\AppData\Local\Temp\52cbc7e32eb06c1733968792f83c3126.exe
"C:\Users\Admin\AppData\Local\Temp\52cbc7e32eb06c1733968792f83c3126.exe"
1⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\52cbc7e32eb06c1733968792f83c3126.exe
C:\Users\Admin\AppData\Local\Temp\52cbc7e32eb06c1733968792f83c3126.exe
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ra_ds.log

Filesize
350B

MD5
0855d5abc50417ca97b1161639866697

SHA1
0e983faf21b0b980ad4f483561e9a259346180f7

SHA256
8e6ad0d20a38edf82601645ab36faebd95faa707fc56c8632c9a5c2ea8f8f1ba

SHA512
05fec4af5b9179b52e62bd6fd9002c19cebcce1530dc7ca45b85d7f23dd4a8bbe9525c707f69f1ddae9a40f320bc281a7f204097fd99290f32c9257b02d73839

Download Submit
memory/1252-4-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/1252-10-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2484-9-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2484-59-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download