205f7ce854944d79e82033b1ae5793d107bba6bd55a220a1163c1ae8b199fdb3

General

Target

a2df851a46a472eff69b8a59bf642a21.exe
Size

1.2MB
MD5

a2df851a46a472eff69b8a59bf642a21
SHA1

d25af66e4d4e1ca95e365b4a78873997f96d8eb9
SHA256

205f7ce854944d79e82033b1ae5793d107bba6bd55a220a1163c1ae8b199fdb3
SHA512

595bf815c813fe4f96f5b658b1f6936fdf5e74edc7e8abc596c18b08e75d6da4fe2efda3eda756118fd5839322e1a35ed51ed2707296a80d43808c07ba5ecc08
SSDEEP

24576:0AbMSe0NArZRTldLRxpyg9fKPlU0Lw62uT+x1fWp2v:0ONerTtvLMw62TH

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a2df851a46a472eff69b8a59bf642a21.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	a2df851a46a472eff69b8a59bf642a21.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	a2df851a46a472eff69b8a59bf642a21.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main	a2df851a46a472eff69b8a59bf642a21.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	a2df851a46a472eff69b8a59bf642a21.exe
2372	a2df851a46a472eff69b8a59bf642a21.exe
2372	a2df851a46a472eff69b8a59bf642a21.exe
2372	a2df851a46a472eff69b8a59bf642a21.exe
2372	a2df851a46a472eff69b8a59bf642a21.exe
2372	a2df851a46a472eff69b8a59bf642a21.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28
PID 2348 wrote to memory of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28
PID 2348 wrote to memory of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28
PID 2348 wrote to memory of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28
PID 2348 wrote to memory of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28
PID 2348 wrote to memory of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28
PID 2348 wrote to memory of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28
PID 2348 wrote to memory of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28
PID 2348 wrote to memory of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28
PID 2348 wrote to memory of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28
PID 2348 wrote to memory of 2372	2348	a2df851a46a472eff69b8a59bf642a21.exe	28

C:\Users\Admin\AppData\Local\Temp\a2df851a46a472eff69b8a59bf642a21.exe
"C:\Users\Admin\AppData\Local\Temp\a2df851a46a472eff69b8a59bf642a21.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\a2df851a46a472eff69b8a59bf642a21.exe
  "C:\Users\Admin\AppData\Local\Temp\a2df851a46a472eff69b8a59bf642a21.exe" Track=""
  2⤵
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\logFile.txt

Filesize
1KB

MD5
072ccedd608a9f2bab864fceb45b3dfa

SHA1
a89a7512a798e3909d1869db3fe7b1c81ab0a214

SHA256
a1c883925ffff0eec0e2e601ab9775c60274fa197c0b3b85e61a1f39b6876d72

SHA512
b4baa2a7b62eccad6f5934def999053b975201bfe1b050798b5f3dd29833afec91fa4d0bdd351391916406b7f4bd7667aae1bab39e709755842cf8639da6a261

Download Submit
memory/2372-16-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-22-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-6-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-8-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-10-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2372-4-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-14-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-17-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-0-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-32-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-34-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-47-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-48-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-2-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download
memory/2372-59-0x0000000000400000-0x00000000005DE000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads