Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/03/2024, 06:14
General
-
Target
bde0b6cb734c367a026bc5364404a5a3.exe
-
Size
924KB
-
MD5
bde0b6cb734c367a026bc5364404a5a3
-
SHA1
c7ce33ecffe0708d1cada917bf575b92a14589a0
-
SHA256
234b8e1aa9c69ab722776ac9ef3dcbe451e5d8f0e7bfdee37470957d5e1dbf2b
-
SHA512
41167ca4016e6bd6eb9f26bbffc432ae0de1b9f34f7c4accd13056fc32c3279e194e5a3d80cc45ff9027797df4ce3228b1e60456bc086632fd16fca789f94626
-
SSDEEP
24576:kq8wRzYCCKpkwrkTiwYuEFvdG2tUzLHmNYhGtRQ:r8ksKptkFYuEFvcYM7ms/
Malware Config
Signatures
-
Drops file in Drivers directory 10 IoCs
-
Checks BIOS information in registry 2 TTPs 20 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 9 IoCs
-
Loads dropped DLL 30 IoCs
-
Drops file in System32 directory 40 IoCs
-
Modifies registry class 64 IoCs
-
NTFS ADS 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bde0b6cb734c367a026bc5364404a5a3.exe"C:\Users\Admin\AppData\Local\Temp\bde0b6cb734c367a026bc5364404a5a3.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 1472 "C:\Users\Admin\AppData\Local\Temp\bde0b6cb734c367a026bc5364404a5a3.exe"2⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 1456 "C:\Windows\SysWOW64\svuhost.exe"3⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 1452 "C:\Windows\SysWOW64\svuhost.exe"4⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 1460 "C:\Windows\SysWOW64\svuhost.exe"5⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 1440 "C:\Windows\SysWOW64\svuhost.exe"6⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 1468 "C:\Windows\SysWOW64\svuhost.exe"7⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 1476 "C:\Windows\SysWOW64\svuhost.exe"8⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 1480 "C:\Windows\SysWOW64\svuhost.exe"9⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svuhost.exeC:\Windows\system32\svuhost.exe 1484 "C:\Windows\SysWOW64\svuhost.exe"10⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107B
MD5dbd765d19b4cbf0041ce39a00096d4f9
SHA1205c3dcc76e1f68cd93c14fcc045f7d7b862da37
SHA256c9c77f029b443d790a6705ff9bf9322d369ab032354b4355516519445a7cdb0a
SHA5122b980cc434a187b025582c1b88e2dbbf45c332a087db4cde642227defa692c5e90d906037ba5db991d6b02bcb0221feba96a6f6ed3e86aab18c25bf5e00ebef3
-
Filesize
107B
MD507359fd12530ab40369865567500f861
SHA1373c960ae22a77bbf39021ac5a4090d5ac1f0448
SHA2562cacde8e236090c3737327f4093bed71663bd81af32c4de937869dbcbfb3f799
SHA512787e728b705e8df1f8b1ae34b63411bc25f6401f173087ddc6bd5405c5efdaa8f867d3180fc0ac116f4c7b442e6d81bc56d6b3b1cf6ad413ee09687e3ba61542
-
Filesize
107B
MD52c2fad0c915a9c4860cce9e42add4bd4
SHA1dd617bdae52e3aa90f48d7dd3b272fc4c37ae445
SHA256382ce6712fddf53f5a495375bcf7a56ce74418e8400db59bdc0edfdb9740a364
SHA51248bb93507aaaaeb5cfb1e1d0eefc00603ea97c6690fddab90471bd4a489cc16349b039b7c999dcf92f08b70382b02ad9e9182a0d26e73c54625ab3d356be608c
-
Filesize
107B
MD504f97a4e802db6f360503ab73814eb7f
SHA11eb568498f7991c0be9bc6a7681e595b3ad78d8c
SHA2568e915b4e8cdcde5160e186b8496cb6f8d459bad54f08676b9794e8c860884388
SHA5129d4c865c334c44eabb00756971b39f5e018142efb03b8b95e17712288e27ac5de0e8678f07a524b4a79f5612d4dd371e4b8082bab38cb8c9130159583ed36862
-
Filesize
107B
MD521c9f2d44fc3cbbe233ea2031f63ace4
SHA1ac53d2b341b1150b52c7d6f8a3b13b4a0bc14695
SHA2565de08d7f74e68c18b80ba354be7810b7c64bc93629f87aba40688c4368278d3c
SHA5120ccdbac4caba269d32f2439e56ee20e2b51efd70aee5e92130f13e3d3e78a2a329367e4903a990a12b7fa20e9dd2a0d2b4ead276a8c3caadd1c18b37f363a9bd
-
Filesize
107B
MD5c06b1afe0d29b5723ba81739d2a8f3de
SHA14d15f38579d6377fc1151b6704f38ecfe7932876
SHA256ffad690194e35d1e2ee3c49eff92d25ec4edd4a5a7f05167637f99c11e4943ac
SHA5125d26c4d9314ac65af93b67f974528bc92f39d6821dce573fa7ffd919e1a5586e6a666c04c80d871db261c68fc4c9ca25c1d8f7e8020606c2f9533879b0b76e9c
-
Filesize
107B
MD524bfdbdf9c439b875f93f1aea83ee858
SHA1a793ce05f72532902684b3654a63c37bcd681fec
SHA25671f3f45e618f64717e9e0066e39e005d1e6f3c0deff05088b4910e7bd9be8ed6
SHA512f5070e40648839e352e02842582f13fda1120809c2983c419a0216f9414ddf5ad07875bcf85e706ad17cc1df618b9ffd7744f94591016945a0364949573f31c8
-
Filesize
107B
MD51667ba51809796cf63be54aa5079ab91
SHA1aec0fa08e98296a5d567e649d4df0a74627a5099
SHA256e193ae9b36a3d69717eceeda6f47857c6dcdc34d1aaad1a687ba4438fcf00bc5
SHA512fcde6133d381b539325ae17a68ecb9da40c9d75ceba746f504fbccdedf1f79ca820ee95076e772799824236e37bc03baa4733e2a5b46a6518edc5d63e8133023
-
Filesize
107B
MD5cf538cd5260468a86c8ba16d33d78ed4
SHA1611a5b512ce625e8c7d2291a063fd55742c2c3d5
SHA256f76a8eab82a0e246c41956eb315e604a74a3eef3b3d6f355f195fea6b9b34e61
SHA5122c8e2864873a7313d711059bf39a71bb2f962e8f3df3911de55511380a42f8ec56ed228a0f50610a3a305ab881f4bcfcfffb69bc53132baa2cd015fe932ac00e
-
Filesize
107B
MD5e44dce771acbf55b4945f7c5c99ae67f
SHA1c4ee1fc7f4fbe49380bd40681957197e732b00a7
SHA2560bfe397d9eb1996e9ea4f91a631fa452a42493ac7277d4720f6c05a15329356d
SHA51219c7ce8b9b9b8b36dab14dd2cfdfe6cd021090e89e43ebae84a1fcfc750c141b86a3e65e2189d6b5e86ee57acd7cc5d7ce2179af001dd481b44d2017c0a65a6e
-
Filesize
107B
MD5a09d3f44cae21f922db9dab6293aee27
SHA1c02977ed774e7f7c61e4654aeaa9e8034bf6ed1f
SHA256f5c16b242de73c0f6c14eae6177db5d121c250fd37d76c1a600c63eecd9ef746
SHA512cfce491a29628628f0eb583bd52afe6cf428322880a4bdcc50511994b7435d44654ba959a5b58e7fc06d6e4cfd3887377b183d228fddeb8cc2c052ce0e6e1f18
-
Filesize
107B
MD54c8d2e994bcf1e0944c06c1c2d114b8c
SHA1357b9b946e7c4290b2387100527d34968b55fb15
SHA256c7b90c535d7ff93d3783e65504e5e7fe94ff0affe0820ff33387f56b855bddbb
SHA512811e1b355606423ceae09cbbf7afde827a59b9670dc00a333c155a0f26a51d54019164e7cfec8b387762be4bb0773e9ef5ad6c9249116bc0704160bae023c664
-
Filesize
107B
MD59aa4708c30ee08be05591e64a0b3dbc7
SHA1b59f0226a5ea243ac1ee50ad8a4e50757562efc8
SHA2565d6ed633170036b685f5bac0f8a495c5965d43bf40e3815a64db6e7e341da4cd
SHA512cd523db078243b39fd9dfb68202ec3009d2912f68d749a0bbaba4feee2a28f26352d1b4716b6f73c771756721dd0654fc57969cb4ac826dda400ca2cf0d73b1f
-
Filesize
107B
MD5b87d4c5efe6fbe6236d3063c4e55eb6e
SHA1530aef5ba04e47aad3f008b49db179ceb85503ce
SHA256459cde4a9382ccd43492a0402dfedaec20625851e3a815dfd1d08cfb4e843248
SHA512cc74f01c3dffdefbfdb4d5f8db4836cfeebccae5b69ffa30980aa6142debd50e21dd2dc5a1abbdfcc35786239fae5b1d40da9264a70b36dbf5cdabd5a6486c8f
-
Filesize
41KB
MD5243126da7ba441d7c7c3262dcf435a9c
SHA142616f7034c0f12e3e4a2166ebe082eb3f08223a
SHA25680d36efd5b3abb82c421149d423e5019c21f203f085ae2655429a44bb5a9f5c0
SHA512f5539774d89e8f025da97e7b49d143b7224fcf899db967a34445de70f9228ea5e2d5daffe6444492ce82a3dfb2734786e09140277c208ec1e64580ad74883e68
-
Filesize
86KB
MD53eb0beb8e318646104362537570fc6bc
SHA13cb48ea9073fcca5835adad307e14ebf0cfe7279
SHA256ab3f8c80b85aae70f89c8e7919d7dd147c2bc3ec68769e0bdb05fcc4083e3643
SHA512db5fd16749641de6282d36af7b1921f908850ece3429ffe5ad33d990431bf4990f0314d28af082394af1f4d66516d9d89806a38e2801c34b4dd1ccb69bfafe47
-
Filesize
924KB
MD5bde0b6cb734c367a026bc5364404a5a3
SHA1c7ce33ecffe0708d1cada917bf575b92a14589a0
SHA256234b8e1aa9c69ab722776ac9ef3dcbe451e5d8f0e7bfdee37470957d5e1dbf2b
SHA51241167ca4016e6bd6eb9f26bbffc432ae0de1b9f34f7c4accd13056fc32c3279e194e5a3d80cc45ff9027797df4ce3228b1e60456bc086632fd16fca789f94626
-
Filesize
234KB
MD5cb0afba4f0fb6ca2b2ea0d2c3e86b588
SHA12459367892e012314b451e05de1f1162448a05fa
SHA2561b0fe60175c88f7cd3f3765b2f0f3eb1530b2e5e5b51f89a83e0322de32bdcf7
SHA512a4e2d66af68dee67be5883c4770c1339b6be4847a993619389404af6a7ec9763361d9a14c632ca6704f63d84b05483f4bea2ec035b466fdaf03ce68c5cbca128
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
84KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
84KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
1.8MB
-
Filesize
596KB