Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/03/2024, 01:57
Behavioral task
behavioral1
Sample
bf89c8680663d48de812dae37b93cf44.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
- Target bf89c8680663d48de812dae37b93cf44.exe
- Size 658KB
- Sample240311-cde12shd99
- SHA256 7e8320a82cbbc4b7890a9b56853c19cdc907b0ab66d0d30046d915b2b20be39e
- MD5 bf89c8680663d48de812dae37b93cf44
- SHA1 84c3031d8fdb8bc1c7d17caa43a30409e6b0eb94
- SHA512 664de5400ed8eb05c51842e2b84fe638b1fc8dd436514899de8495537843a9620949ba864bc408b4904c8cf1de8128a6327cebc0b45193ef1b6994afb8a86e01
- SSDEEP 12288:x9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKV2:HAQ6Zx9cxTmOrucTIEFSpOGE2
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate bf89c8680663d48de812dae37b93cf44.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2816 set thread context of 3916 2816 bf89c8680663d48de812dae37b93cf44.exe 87 - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 bf89c8680663d48de812dae37b93cf44.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString bf89c8680663d48de812dae37b93cf44.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier bf89c8680663d48de812dae37b93cf44.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier bf89c8680663d48de812dae37b93cf44.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier bf89c8680663d48de812dae37b93cf44.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeSecurityPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeTakeOwnershipPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeLoadDriverPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeSystemProfilePrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeSystemtimePrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeProfSingleProcessPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeIncBasePriorityPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeCreatePagefilePrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeBackupPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeRestorePrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeShutdownPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeDebugPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeSystemEnvironmentPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeChangeNotifyPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeRemoteShutdownPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeUndockPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeManageVolumePrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeImpersonatePrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeCreateGlobalPrivilege 2816 bf89c8680663d48de812dae37b93cf44.exe Token: 33 2816 bf89c8680663d48de812dae37b93cf44.exe Token: 34 2816 bf89c8680663d48de812dae37b93cf44.exe Token: 35 2816 bf89c8680663d48de812dae37b93cf44.exe Token: 36 2816 bf89c8680663d48de812dae37b93cf44.exe Token: SeIncreaseQuotaPrivilege 3916 explorer.exe Token: SeSecurityPrivilege 3916 explorer.exe Token: SeTakeOwnershipPrivilege 3916 explorer.exe Token: SeLoadDriverPrivilege 3916 explorer.exe Token: SeSystemProfilePrivilege 3916 explorer.exe Token: SeSystemtimePrivilege 3916 explorer.exe Token: SeProfSingleProcessPrivilege 3916 explorer.exe Token: SeIncBasePriorityPrivilege 3916 explorer.exe Token: SeCreatePagefilePrivilege 3916 explorer.exe Token: SeBackupPrivilege 3916 explorer.exe Token: SeRestorePrivilege 3916 explorer.exe Token: SeShutdownPrivilege 3916 explorer.exe Token: SeDebugPrivilege 3916 explorer.exe Token: SeSystemEnvironmentPrivilege 3916 explorer.exe Token: SeChangeNotifyPrivilege 3916 explorer.exe Token: SeRemoteShutdownPrivilege 3916 explorer.exe Token: SeUndockPrivilege 3916 explorer.exe Token: SeManageVolumePrivilege 3916 explorer.exe Token: SeImpersonatePrivilege 3916 explorer.exe Token: SeCreateGlobalPrivilege 3916 explorer.exe Token: 33 3916 explorer.exe Token: 34 3916 explorer.exe Token: 35 3916 explorer.exe Token: 36 3916 explorer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2816 wrote to memory of 3916 2816 bf89c8680663d48de812dae37b93cf44.exe 87 PID 2816 wrote to memory of 3916 2816 bf89c8680663d48de812dae37b93cf44.exe 87 PID 2816 wrote to memory of 3916 2816 bf89c8680663d48de812dae37b93cf44.exe 87 PID 2816 wrote to memory of 3916 2816 bf89c8680663d48de812dae37b93cf44.exe 87 PID 2816 wrote to memory of 3916 2816 bf89c8680663d48de812dae37b93cf44.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf89c8680663d48de812dae37b93cf44.exe"C:\Users\Admin\AppData\Local\Temp\bf89c8680663d48de812dae37b93cf44.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3916
-