Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
02/02/2024, 23:32
General
-
Target
8acfd4b5862e9e780665ba9e8385993b.exe
-
Size
676KB
-
MD5
8acfd4b5862e9e780665ba9e8385993b
-
SHA1
2398993394dccdab067aff4c1a575a6ea877ad68
-
SHA256
ea4bea83f66080c7d7886f687ad3c56bccd6c847bb01507a4ae839ab1f0889fc
-
SHA512
5852d64e64b4bac0cfdea7f492335f21b88a9b9f2b5b33113ef926c9a4753769d7ee42d2492e44d019380b1333341f87830c925cd09fbaac2497887816be24aa
-
SSDEEP
12288:8aAIgAP1HRT7/EvxX5GR6a+DlGxIuy8tWggdiL8Uj:8aNgAP1HREWR6pZr2gkLj
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 10 IoCs
-
Drops file in System32 directory 22 IoCs
-
Modifies registry class 64 IoCs
-
NTFS ADS 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8acfd4b5862e9e780665ba9e8385993b.exe"C:\Users\Admin\AppData\Local\Temp\8acfd4b5862e9e780665ba9e8385993b.exe"1⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WinSecUpd.exeC:\Windows\system32\WinSecUpd.exe 1420 "C:\Users\Admin\AppData\Local\Temp\8acfd4b5862e9e780665ba9e8385993b.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WinSecUpd.exeC:\Windows\system32\WinSecUpd.exe 1464 "C:\Windows\SysWOW64\WinSecUpd.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WinSecUpd.exeC:\Windows\system32\WinSecUpd.exe 1476 "C:\Windows\SysWOW64\WinSecUpd.exe"4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WinSecUpd.exeC:\Windows\system32\WinSecUpd.exe 1480 "C:\Windows\SysWOW64\WinSecUpd.exe"5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WinSecUpd.exeC:\Windows\system32\WinSecUpd.exe 1472 "C:\Windows\SysWOW64\WinSecUpd.exe"6⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WinSecUpd.exeC:\Windows\system32\WinSecUpd.exe 1488 "C:\Windows\SysWOW64\WinSecUpd.exe"7⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WinSecUpd.exeC:\Windows\system32\WinSecUpd.exe 1404 "C:\Windows\SysWOW64\WinSecUpd.exe"8⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WinSecUpd.exeC:\Windows\system32\WinSecUpd.exe 1484 "C:\Windows\SysWOW64\WinSecUpd.exe"9⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WinSecUpd.exeC:\Windows\system32\WinSecUpd.exe 1496 "C:\Windows\SysWOW64\WinSecUpd.exe"10⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WinSecUpd.exeC:\Windows\system32\WinSecUpd.exe 1492 "C:\Windows\SysWOW64\WinSecUpd.exe"11⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
125B
MD533ee11d05440e0b7f9f6611744fe40a0
SHA19906d2299ab9f49a9c028b04083e00762e588e73
SHA256b978ea625976663fc7965f3c429c34a7b6d29c1415b4f54aa0e9e74f4fd2891c
SHA51238e2577f98df34d639c9100695002f0ad2864b76a351557599a0fb7e9f9cb8446d433f6942ca5d006a4394af518a8ad7c476291186571cffc6f6933fdd324131
-
Filesize
125B
MD56b040babdef9838e0195a7ad99de4757
SHA142e89b2a7f7f5e6fb5693ee39cc7d6fdaa037141
SHA256dc292627fe6a7c64234e7d4303105ce5b8fd0c01bd7f4075075940399e365bd3
SHA51276867f1077a1d9a678f1574627f4835b7d9dcefcd0947f2b259a0fb32425b7a5ee864cd9ed3ce6557ce87748bdf1b40f4b3f5014d46a228565a059c30defe6d1
-
Filesize
125B
MD523e89f814a582832c65e899e837151ca
SHA1a8ba48b7848c9cef42a04915b335a069a14563b7
SHA2567f941d3705491cdd2cfb0d498608136a71d8690621f2ae18b0729451e7e9d2c3
SHA5127925fc8babf955775cf9b8ab4be2e22f5d136886b1c4460cff120ecaace2d1ab7aa1b53ec06c1eb57d23fa72bcbe255635bd129684ada18963a7d195bb013ed4
-
Filesize
125B
MD542a40a55599acb6e5371b7a07d4e3853
SHA193f755ee1e44210bac63c0c0e90de0070c4597be
SHA2560715492002a4249c6d98e2322cf0a3f41bbb6cd0a5d45f5ce4e19365148fc7cd
SHA51263893d98c023994b40ccf19d8a2f6db9181f130928e8a3ced36e9f3dc85d170d603d7dec8e2392156440fdad3e32103ca875b80020c9c6605252336f996eb548
-
Filesize
125B
MD51a397d6c5d9cfe3e8ab1e1d7c436590f
SHA1884ba97b9f0e2a27661fad1a37450d15cb199a19
SHA256899d8e6c50bec141dc3fb72c29fc1ceb1e31570e99d46e848e8149fa84fd9e19
SHA512ac7cba311122bc806230b867047023f8d849e06a4303269f56824e9e7454fd009ff4bf1a48c69ad4ec9139a76de2c8bc2c537ae0fb9ab3ec2cf5a216808b81d5
-
Filesize
125B
MD55663eb785f0badc0e74d340e2b01da76
SHA1c5b3aa35e1680669cb63af67ea82ad1014cb718d
SHA25640c7b17582435fb51aa3278f40b0c6617b8983a04ccb385d87514107db158940
SHA51297af09b37a21e8ab18292cf37948168b002a22e6b54119b890156427effbf3e2e7bf46552ae7d7a9ec31f7c10045e50d28b954ce7c09be213604a3f4a4a669b2
-
Filesize
125B
MD5fbfb918aafb5912729dd7cb03c7a9f10
SHA1e4ab1c040a0c62dd16c4d5b6723a13b448e6fd00
SHA256cb348eac556b515a3f7d43fe08f3af6388b7e5d115e872b3d76d652cb025d4b5
SHA5125726d2dcd9bdb77b83c0adb79da96c78f223f332bd2580a61b472775b3ae74a24dbe9b2c6fcfa8988d6cbab8f616f19d077ccdd622d2d6360c43112b10d7a11c
-
Filesize
125B
MD5b436c95f25842c7119795d7523b3b69c
SHA1918ece9875e85dcabc0ed436d200c229b751364f
SHA2563363001652f2863e99577114a43fd9ef2f860906c1df47d89c904885b3d342c1
SHA51247a555aa5fa1a580a1cbfa91e06b2806f9408390477417cb811163689bd1241eeebc6d3e5f301de5a3b40e9e93298da06544c6a497a4aa540577d5deeb2fec17
-
Filesize
125B
MD58733831cd655220ed96641d923eb936c
SHA1b0d540557f541cfdb03f7495e066b595a7ca53e0
SHA25692ab99d4568847a924a2272f1110f640a55f1b3de0bfa8e29b6bd4fa230773b6
SHA512db0278e493e246c6a6d1e374f56a43b19c367448ca8a07885ecfbad6ce34c55586337d3354295fbc1f43d9b12301af0f711224f16335344959e9d762c7555192
-
Filesize
125B
MD52e9a431eea244ef4b4b1f148cd78dc43
SHA119c3b43de9abb743abb0b2e91e6428884ed16611
SHA25664c31e95562f04db85ada1850faea10227108116b1b8adf431d65e18e8f245e5
SHA51227decd20e0330f290790b85e25080f51b7b23c5ca2f6d945913ac095702b9fcf0d81d4f122cccf7107359679a7e96c950ac39c3191df13f765cb407d3e2649df
-
Filesize
125B
MD5e170ab546585945030d12f58dbf79876
SHA1c47f025691c5f772a0779862a61cd7a357bf9ace
SHA2568c90720c4907dea00f67529a5fd1c040532384ff91fbacda46f803c5feca47a8
SHA5126cdbad634351c84997d97cce2e2bc896e7a7f6995d0df78db00b6500aafb2ecd0b49e5c00210459c93a1206e96f622398ca0ba3cae2c37ae6d365ed131865878
-
Filesize
125B
MD5373142b59d5bdd311624b55a2195dea1
SHA133b74ab060fa8b4fab9294931f191522bf295f0a
SHA256a2e2688657e26a8b3d3da6026469ed4779d76aea5bf9375d607588610d84f3e3
SHA51224d119f934f6f0dd00a504daa95161a7c3d4631625cbe2c3ff6fb8e9ac5cbf75dbe93e8a210387f72eeb458a8623c04de20e1bfef72972a0596b7962fd5475cc
-
Filesize
125B
MD55194edaeb8a0bfc25f97fc44ddba066d
SHA110dec3d7d65bf3faef0fb8f698676007b9b795c5
SHA2568b48a4f38865a834de7b6819849748d141654e3a4d51c8fb85406c9765bd02bd
SHA51233054fe48cd88b83b813d356276e06a5e1710d9d8d54e75f58a72b20f0f10d4d44971019017563f95575e810134a81f317489a8b2cc0124a23a240ecb8f76e6f
-
Filesize
125B
MD5c6bdf0d2b6bb6393ac46c0af424e62ee
SHA1ad35a691ccfb225cd12c3398da82527e5ce1fb14
SHA25694c212a30189d7a58478b9a3bef4866a5d936985ea3852e5f94635cf2965a76c
SHA512005593747b4bf43855bfcff54a0dc183af00cc44d49c4be5c6fc0913042bb2a989bdf2c37fbeb8c975098ddeaf2feb773070d7cfe94f558e58f48337b485550e
-
Filesize
125B
MD548a7f44686e1894089761aa06ac650bd
SHA1e0207931039b922f0b62437adbcf2c2e0faa6772
SHA256eda19bbdbfdfac737beda760a5f455a368dde2f8f3dc3b590d6122c9ad067737
SHA512790d55033fd37313ceba79196447a8bbb40d93c2de4f6e5fcf23dd13244b40dbb2a489a61a559c6f3d3a5c2bd8f92c47cd1a1f5d6739c3d14c47b21508804679
-
Filesize
125B
MD537ab7071f9fad4dd6954128e2bbb3aed
SHA146326d43021ea5a89a73c45c1c596980bcedb00e
SHA25682187f808150b2b60f451ca5f53c443b273781f0e6853817dae9bf7435cd4538
SHA512cb57b4b2b88beb445ac6dbee97f8a41fc6254948d2ad1995f43fd330dfcbb0af8965c7f3ece09ee862e32e109d2dec568896586a2227a5bbb8e86cec3eff1a69
-
Filesize
125B
MD594d4762e47517f9fb6bb6c490d06cb59
SHA170e42483b68536e3451e901bbd013871db085134
SHA2564da2cb277c2865339d86c2f71e3f861082c9f59ecc12be3e9571a47c158d96cc
SHA51272b412bca73eb394a90fa5a58881334924427f022ab3cfc8813a315323bc6482e792a352e0604cfd8d811d50bccd54fa0a7443a50b24c707c6c0548e77e55a1e
-
Filesize
598KB
MD5136f48600b29e7aac2810df2408992d3
SHA16fc6ef7d196669abf347ef9bc3d3d469b1bc6923
SHA256a444ce300f9053146a0ab0cefe780757eec905b74b6fbc210bfd5e7fcda255dc
SHA51271a85d7f3d5e2b63ea41454d21495a4676fd6b1c515566d305d92eb2bed797771af33e4aec53b00fb3b93117450f3555a584678bdaa879cb8cc3f020ae4b4127
-
Filesize
676KB
MD58acfd4b5862e9e780665ba9e8385993b
SHA12398993394dccdab067aff4c1a575a6ea877ad68
SHA256ea4bea83f66080c7d7886f687ad3c56bccd6c847bb01507a4ae839ab1f0889fc
SHA5125852d64e64b4bac0cfdea7f492335f21b88a9b9f2b5b33113ef926c9a4753769d7ee42d2492e44d019380b1333341f87830c925cd09fbaac2497887816be24aa
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.8MB