Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10/03/2024, 06:14
General
-
Target
bde0b6cb734c367a026bc5364404a5a3.exe
-
Size
924KB
-
MD5
bde0b6cb734c367a026bc5364404a5a3
-
SHA1
c7ce33ecffe0708d1cada917bf575b92a14589a0
-
SHA256
234b8e1aa9c69ab722776ac9ef3dcbe451e5d8f0e7bfdee37470957d5e1dbf2b
-
SHA512
41167ca4016e6bd6eb9f26bbffc432ae0de1b9f34f7c4accd13056fc32c3279e194e5a3d80cc45ff9027797df4ce3228b1e60456bc086632fd16fca789f94626
-
SSDEEP
24576:kq8wRzYCCKpkwrkTiwYuEFvdG2tUzLHmNYhGtRQ:r8ksKptkFYuEFvcYM7ms/
Malware Config
Signatures
-
Drops file in Drivers directory 11 IoCs
-
Checks BIOS information in registry 2 TTPs 22 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 10 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in System32 directory 44 IoCs
-
Modifies registry class 64 IoCs
-
NTFS ADS 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 40 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bde0b6cb734c367a026bc5364404a5a3.exe"C:\Users\Admin\AppData\Local\Temp\bde0b6cb734c367a026bc5364404a5a3.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 732 "C:\Users\Admin\AppData\Local\Temp\bde0b6cb734c367a026bc5364404a5a3.exe"2⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 748 "C:\Windows\SysWOW64\svuhost.exe"3⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 376 "C:\Windows\SysWOW64\svuhost.exe"4⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 756 "C:\Windows\SysWOW64\svuhost.exe"5⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 772 "C:\Windows\SysWOW64\svuhost.exe"6⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 764 "C:\Windows\SysWOW64\svuhost.exe"7⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 768 "C:\Windows\SysWOW64\svuhost.exe"8⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 776 "C:\Windows\SysWOW64\svuhost.exe"9⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 780 "C:\Windows\SysWOW64\svuhost.exe"10⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 784 "C:\Windows\SysWOW64\svuhost.exe"11⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107B
MD5a8a11a2131f63650ce328f48b642afb8
SHA1710107f9bab0dd4e81afdfed5dce7c5060ce233e
SHA256d15d2df56b98164f5f0827909e2dee248937791caa3e18a729befccbadbc9d69
SHA512eb198c41844289c22f592838188855f45f532b550519faf817d8bfddad90bc38dba860af36b355ed6aec436f1794fd1cb1a9fea18602334bc25f6b6bbd97c454
-
Filesize
107B
MD50d211942554121d3e7803c452be51c0a
SHA10920c1aee26ff35eb8fb246ac850c8c99066d238
SHA25685338afe4bcb31239441aef3bae875e017ae5084f4fb88e2fee2362dcb7c30b2
SHA5124cef0cb7508b02b7a15d24568b0d8404098551d05f185a6046cbe340ff08973d7a0e1557282d9c8e68a3a19078ddcff5bd46dcfb53cae2d6213261c54cdcd82c
-
Filesize
107B
MD563158a2730d318a526e0cd05ff5e9af1
SHA1d14d9dc778cefeed922a596d6eef00c85e9b7be4
SHA256fcd0cd0e67ed8a2d05830ffdea4a8d6b3cdb5f54365a102f2ba5dcdd4fb59a32
SHA5126daba2d40c2a36c56706aef3f6f764b1acdc7cf86dc8481f60c2a308376087c5e2a079399eacd1707406a2c3b0e2f59808235113d84d973c5e21a4e7e468547f
-
Filesize
107B
MD582da14085f14de641760362db5d99dc8
SHA1d82caddecf6f32affc06657930ebafbea3168c58
SHA25682069a8bb6dd1acc811ab47f61118556e0517ef950ecfafcfa510f0f6a283e05
SHA51299c674ded401e602155747f67c5353ab9481a2bec164f284a817618902bc56f3e2f32f92e1d976cd585200e8a48e2115a9bdc779220a8d3996a36a1c27396301
-
Filesize
107B
MD532f8bfd232a21161ffb2f1193223bd4e
SHA1c04831ec852aad4e84642d33fffa266e644ad365
SHA2569ffef5a528cc78342b3e3e9af255e24a211781d86a266e826b58b1f5d82aded0
SHA51213d4b5540400709aea4473bc591a23b4fedaf207c0ed24c73f1b8ffbf38259012dec657781dfb72a5c6442a3f28e5b378ceb5825518cfcaf8e3ba5a9c2532258
-
Filesize
107B
MD505785809dcae0b577d58a28a63b87996
SHA1cede358bfe49fc6187b4db36c6d32e03f48fa209
SHA25613942ab6a33ce99cd1120e3c01a84217c63d4f0da0cb5c42ec9e690484977be8
SHA512d2d84b6ea26c6d51ba9122aac1bce66ad9a0361f107d1442a4841fbba19d5a5f64953c893e279403f990bfb2c4ef8a0e88f6acbcfcf017c538c8fb7264fe2bf8
-
Filesize
34KB
MD56bc6343206d368942cabee56b00282d3
SHA14ee0cdc2912afb17e979cccf79d33c43867d6da3
SHA256bec5cd0363e6ec531761c839ca20608a79d1664a1b9c1039ac677596417cfa1f
SHA512817291a85b8a688316a1c0df5da0da67edc5716b90460f5e46b0156ce8a84df882b265b5c4904464fcf8c6cc0289664cd8f11c2a4a9240849f53f05e2f527c07
-
Filesize
503KB
MD5cabc9c6b1ade6a90e3e9057c329c2c41
SHA19991d002e1bc4f2a2506f2270a5c71ce0f7cb974
SHA25665e7046cf012c7fe23620068c34e4204e4ab0e8a223ad7610e1ef84c089f501c
SHA512bcf1ba84691f8b451fdf88830bd0933afe5b6b61747b6cdd372263cc8ed5c354eda6b0c68c2dbfd0430eb92cf12aced478e8e2f35e6678a52db7aa5c237a53bc
-
Filesize
487KB
MD57c6e898bbf29424dc664adb9ff40f480
SHA1c6d7c1a3c26eef7413eaa7381d2f010242435142
SHA256fb005d880c13bdc7cd4a7601a45552be8a5fec1b192c2e39805c0953228bdefa
SHA5129c0de420f1207c26d981a29812ddc3a26879cccffb59624d3110e3ba7f77df7f4240eb66ade19f04a46f89f457eb5987016b20a69f76d105aea509c89835db8d
-
Filesize
217KB
MD5787c68b0c88853e5b9319cfadf8e561c
SHA19bfbaedc710e4a0ca6df027bf5982acc59d3e334
SHA25640ad827a24882c16ad190f8009ae8b0f2affc1b302f40968c7c1fabe7bd3727f
SHA51240eb2d667b97b36c98e278687a1cfc1fbff569cb64ead6957d8d278c5888ac4d5ad33c3a228a4f1645ff705e522670553af7e951f3dbce3309fd70cea0e61a0f
-
Filesize
41KB
MD5243126da7ba441d7c7c3262dcf435a9c
SHA142616f7034c0f12e3e4a2166ebe082eb3f08223a
SHA25680d36efd5b3abb82c421149d423e5019c21f203f085ae2655429a44bb5a9f5c0
SHA512f5539774d89e8f025da97e7b49d143b7224fcf899db967a34445de70f9228ea5e2d5daffe6444492ce82a3dfb2734786e09140277c208ec1e64580ad74883e68
-
Filesize
86KB
MD53eb0beb8e318646104362537570fc6bc
SHA13cb48ea9073fcca5835adad307e14ebf0cfe7279
SHA256ab3f8c80b85aae70f89c8e7919d7dd147c2bc3ec68769e0bdb05fcc4083e3643
SHA512db5fd16749641de6282d36af7b1921f908850ece3429ffe5ad33d990431bf4990f0314d28af082394af1f4d66516d9d89806a38e2801c34b4dd1ccb69bfafe47
-
Filesize
768KB
MD5bc127a0d4ade9e86833bad54c858770b
SHA1f1f8b9c30fca68a5e95420e2f734dc81b1e8d31d
SHA25649de02f0678c83960d1ca0b342e8c164be69b08b2a25e7f98b73dc8b65a66bcf
SHA51230d2dac0f165910c6d7f04f7d0743198e944bdb5a2a3d45b02de8e1daaabc8912c9010cca3236b946d3a5b0c6fb1b7fa10c772af77fcd901d4a660c2979b029a
-
Filesize
192KB
MD5bfa990f40c941168fefe15852d7a00ed
SHA13e61701409cfad09f913522085e3c2c821c43431
SHA256b2d412fe1120cf5495606f27a44c7e8f4f921d021dc0a7a26aefd274068d5c6c
SHA5121574d17727c830b1d576a52c1bef414bc8b4e4cdc3364feac8a3f51f523fd27e2b56ce534306e5f8344e422317dcc374f339b35c1c17964160e3194b1adaedac
-
Filesize
499KB
MD50423a14bef73cb98f0e3bafceffef067
SHA10c4f1b23409d644689682cf7b93d5371bc911ebc
SHA25684f00980264d497aacc2764c91e25dcdcb42f0aeea8b087a228cbe87ea78ded1
SHA51235a4b22b6adbf0dabae7d6e889e3020caba248930364b9beef533643b9a804f44b609292326611f39c9b9b43e732670cad2bc422f43e8945a4c769dd83daabb3
-
Filesize
623KB
MD557abd76c39b41f7e1e4c73107897e2b8
SHA143a2b50753d4f60477c289878293b7f56d67e9e7
SHA256e5ed367404b37543d5bba75d339f88bba05957a59712d8e323f251005357e777
SHA51274d1b3760a86f174699f609472816fba9cce402eed1f66f5780eaa70b861400bf58880426e69a1fe27b9fb58795c33bc5a084ebcbbf8c693f80fc097141ce326
-
Filesize
924KB
MD5bde0b6cb734c367a026bc5364404a5a3
SHA1c7ce33ecffe0708d1cada917bf575b92a14589a0
SHA256234b8e1aa9c69ab722776ac9ef3dcbe451e5d8f0e7bfdee37470957d5e1dbf2b
SHA51241167ca4016e6bd6eb9f26bbffc432ae0de1b9f34f7c4accd13056fc32c3279e194e5a3d80cc45ff9027797df4ce3228b1e60456bc086632fd16fca789f94626
-
Filesize
234KB
MD5cb0afba4f0fb6ca2b2ea0d2c3e86b588
SHA12459367892e012314b451e05de1f1162448a05fa
SHA2561b0fe60175c88f7cd3f3765b2f0f3eb1530b2e5e5b51f89a83e0322de32bdcf7
SHA512a4e2d66af68dee67be5883c4770c1339b6be4847a993619389404af6a7ec9763361d9a14c632ca6704f63d84b05483f4bea2ec035b466fdaf03ce68c5cbca128
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
36KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
36KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
36KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
36KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
84KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
36KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
36KB
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB