debf351be78e09aba6a74dd649077d4b7ed011f244b6e0e0ab3c75577828862f

Analysis

max time kernel
7s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deskspace.exe
Size

1.5MB
MD5

fd0a106014f362778569d61e64b73d24
SHA1

b18f602d1fd9c13385af854ff8df36968a142fbb
SHA256

4b34f71c40f17285191010f398707ae4d0e2312c989546b047791529fc95cee7
SHA512

340695bb352ddb4d4bfd3605d9ec2e20c5f67efe96017f87dd9441a868b9196c7ad20a85e62eeae3c26a087f7edf2c838c96eddfc3a157c9676aabc7cdcede80
SSDEEP

24576:xbT3qj3IFVBN2ndhfVvZ3a/2ZuZz+cYxTlbEWRyYhoIjjxx:tT3qj3IVyVEeZ1cs79mIjjxx

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	deskspace.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	deskspace.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\Desktop	deskspace.exe
Key created	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\Colors	deskspace.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1808	deskspace.exe
1808	deskspace.exe
1808	deskspace.exe
1808	deskspace.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1808	deskspace.exe
1808	deskspace.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1808	deskspace.exe
1808	deskspace.exe
1808	deskspace.exe
1808	deskspace.exe
1808	deskspace.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49
PID 1808 wrote to memory of 3600	1808	deskspace.exe	49

C:\Users\Admin\AppData\Local\Temp\deskspace.exe
"C:\Users\Admin\AppData\Local\Temp\deskspace.exe"
1⤵
- Checks BIOS information in registry
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\deskspace_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\deskspace_x64.exe"
  2⤵
  PID:3220

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-0-0x0000000000400000-0x0000000000714000-memory.dmp

Filesize
3.1MB

Download
memory/1808-1-0x0000000000400000-0x0000000000714000-memory.dmp

Filesize
3.1MB

Download
memory/1808-2-0x0000000000400000-0x0000000000714000-memory.dmp

Filesize
3.1MB

Download
memory/1808-5-0x0000000000400000-0x0000000000714000-memory.dmp

Filesize
3.1MB

Download
memory/1808-8-0x0000000000400000-0x0000000000714000-memory.dmp

Filesize
3.1MB

Download
memory/1808-9-0x0000000000400000-0x0000000000714000-memory.dmp

Filesize
3.1MB

Download