Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
17/02/2024, 11:09
General
-
Target
BGA2Editor.exe
-
Size
5.2MB
-
MD5
dc183625a6758b99a7b64dc2d62e11cb
-
SHA1
68ecb6ab59d4bdea7cf02abd5ca0a06718ae6ae7
-
SHA256
f256637308860a3a1e4367f6546f5615bbd2d49ac12595ec884ed5979f9fc5b7
-
SHA512
27669d63203395bba527a25ea790cc2d66b835e1ec8fc8c70569d16b799681a112f4385a0885383b7904e3749fd8493ad8bbf42c2df1a3c36eaf0628638e5786
-
SSDEEP
98304:PlJ8P47JU8Z2xxzSsOVmMUE3dm+ZhYfBeEClx2SejCLEqpY+s9gbYUO5y573f5td:PlJSaJNESeE3M+ZhMBevDdep0Y+s9glz
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BGA2Editor.exe"C:\Users\Admin\AppData\Local\Temp\BGA2Editor.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BGA2Editor.exe"C:\Users\Admin\AppData\Local\Temp\BGA2Editor.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Desktop\LockUnblock.ppt" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5564d2eea8c51b3e9e3df2975214136bc
SHA170a30b59223a418561c321354c45380d2aac6c20
SHA2560ca311b4ac08daa87040dd9d91a84068727b9a96b40115dfbf9c614b08a887d8
SHA512dc35b3ebcc472f81f8a3b75d1023b6796411a260c6bb10f315f0cd313cb5a48ee1460db28a83e25d7512efed863a47b3e3e4915afb7337f63ebd143700d9db41
-
Filesize
87KB
MD50e675d4a7a5b7ccd69013386793f68eb
SHA16e5821ddd8fea6681bda4448816f39984a33596b
SHA256bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
SHA512cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66
-
Filesize
762KB
MD5a40ef803eed5fd08d569213f83b77236
SHA1059bb4f5aebd1d5176452701e345e30e5b5b8ca4
SHA25693220367150060d3a0669669c1a11376a6319690c37c7fc6bdcf3180e1cf650e
SHA512d0c52ae48c99543fee5ff17769234879cd582e4abfa4435072478ffab29b1b885672999471cfdb65fa66b3411c23099c0cb4971a5bea11c309b36c704af714a2
-
Filesize
3.6MB
MD522546a966149e4f545e00d0c0c294a53
SHA13d51c13be6cd7f115934bfa9ef8a3ddd3f571949
SHA256b01884bced504e81edb83da4c0e6c3098d87c1512d60bb85e88ecd1a937ed2a0
SHA5121a62a837b42e6ecb149d034826929a9d818571ac7b830b380899bdcf3b72307025d2f47b7d6013cab2725ccbdc1af9ad4b733be75dfe030ecd674d7927b90eac
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB