Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28/01/2024, 00:19
General
-
Target
Detection.exe
-
Size
4.7MB
-
MD5
a3c41ba672d3041502032b1ed41863d3
-
SHA1
ea1994e50246378083c8ea990016bd7bfe7366a1
-
SHA256
aa9f115736228a31a9311a7b3f09f35d6846343cba028ac575797a8f67b87fd6
-
SHA512
8d3678b2e1d8d63f0a01bac75a94c765cde004bc6e58d4a49d70c96df9ce843a18c30a8a04f158bcd8d0e77b0c584b7e98e8465860259c679e7d99d221669942
-
SSDEEP
49152:Lb7KDwjsx9v81weTF6HBx9ZRwwURV4a2NAzZ0Sqd7EU8KYZlXrp6nSh3y4PviaJs:x3jNLsCzZ0Sqmyu96ORiac9
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Detection.exe"C:\Users\Admin\AppData\Local\Temp\Detection.exe"1⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
368KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB