Analysis
-
max time kernel
145s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2024 06:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52cbc7e32eb06c1733968792f83c3126.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
52cbc7e32eb06c1733968792f83c3126.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
52cbc7e32eb06c1733968792f83c3126.exe
-
Size
246KB
-
MD5
52cbc7e32eb06c1733968792f83c3126
-
SHA1
d54d613adf041f686c9cf7fe46b888214b141d1b
-
SHA256
c1bcecae17d0cbc368de2bda44bcdf9ce432125b13b7f5c0969b6b0f68d131cb
-
SHA512
9f2dc0377c5a1f8a08ee4b3471595a038b52d68fbaf8a0f0ddf47554206cfaf37a87effa488acaf740c78f38590e77c81a969cafcc3d629a9f64df5911e3749a
-
SSDEEP
6144:VauE1BXgF6GFI0uNTHPewM5pb5dcAyQnPS+0v8d:VuQF6ANuU5pb5SunqE
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ra_ds.log 52cbc7e32eb06c1733968792f83c3126.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 52cbc7e32eb06c1733968792f83c3126.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 52cbc7e32eb06c1733968792f83c3126.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 52cbc7e32eb06c1733968792f83c3126.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 52cbc7e32eb06c1733968792f83c3126.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 52cbc7e32eb06c1733968792f83c3126.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe 1668 52cbc7e32eb06c1733968792f83c3126.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52cbc7e32eb06c1733968792f83c3126.exe"C:\Users\Admin\AppData\Local\Temp\52cbc7e32eb06c1733968792f83c3126.exe"1⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\52cbc7e32eb06c1733968792f83c3126.exeC:\Users\Admin\AppData\Local\Temp\52cbc7e32eb06c1733968792f83c3126.exe1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:1668