e5033e37f106ad130d60994645e63502fe112bd085434141b8b0887baf83631d

General

Target

c43ebd87832cb18c5edbb998cad14caf.exe
Size

740KB
MD5

c43ebd87832cb18c5edbb998cad14caf
SHA1

973aba913289892f96d50846f5706dfe53f2914a
SHA256

e5033e37f106ad130d60994645e63502fe112bd085434141b8b0887baf83631d
SHA512

5531644333e10369560308ca154c25fa3a0908bb24420585fe44e9569506edbf5761b30657b6e7c0bd214db97d07dd68720fb88b2968ea09b46fb249ea88a1f5
SSDEEP

12288:+PoP05XScnWB6V2EJWGciKCXsDNNnWjDgt5plQsWWqVfavcSqfpGY7Crnts:KXNYvesRBWwLVWWtqkrnts

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c43ebd87832cb18c5edbb998cad14caf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	c43ebd87832cb18c5edbb998cad14caf.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\ = "Outlook Message Attachment"	c43ebd87832cb18c5edbb998cad14caf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\AuxUserType	c43ebd87832cb18c5edbb998cad14caf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\LocalServer32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OUTLOOK.EXE"	c43ebd87832cb18c5edbb998cad14caf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\ProgId\ = "MailMsgAtt"	c43ebd87832cb18c5edbb998cad14caf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\AuxUserType\2\ = "Message"	c43ebd87832cb18c5edbb998cad14caf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\ProgId	c43ebd87832cb18c5edbb998cad14caf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\Verb\0\ = "&Open, 0, 2"	c43ebd87832cb18c5edbb998cad14caf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}	c43ebd87832cb18c5edbb998cad14caf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\InprocHandler32\ = "ole32.dll"	c43ebd87832cb18c5edbb998cad14caf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\LocalServer32	c43ebd87832cb18c5edbb998cad14caf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\Verb\0	c43ebd87832cb18c5edbb998cad14caf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\AuxUserType\2	c43ebd87832cb18c5edbb998cad14caf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\InprocHandler32	c43ebd87832cb18c5edbb998cad14caf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD1CE02D-AF4A-D59A-C793-F8D23DDBEB6B}\Verb	c43ebd87832cb18c5edbb998cad14caf.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2360	c43ebd87832cb18c5edbb998cad14caf.exe
Token: SeIncBasePriorityPrivilege	2360	c43ebd87832cb18c5edbb998cad14caf.exe
Token: 33	2360	c43ebd87832cb18c5edbb998cad14caf.exe
Token: SeIncBasePriorityPrivilege	2360	c43ebd87832cb18c5edbb998cad14caf.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2360	1872	c43ebd87832cb18c5edbb998cad14caf.exe	28
PID 1872 wrote to memory of 2360	1872	c43ebd87832cb18c5edbb998cad14caf.exe	28
PID 1872 wrote to memory of 2360	1872	c43ebd87832cb18c5edbb998cad14caf.exe	28
PID 1872 wrote to memory of 2360	1872	c43ebd87832cb18c5edbb998cad14caf.exe	28
PID 1872 wrote to memory of 2360	1872	c43ebd87832cb18c5edbb998cad14caf.exe	28
PID 1872 wrote to memory of 2360	1872	c43ebd87832cb18c5edbb998cad14caf.exe	28

C:\Users\Admin\AppData\Local\Temp\c43ebd87832cb18c5edbb998cad14caf.exe
"C:\Users\Admin\AppData\Local\Temp\c43ebd87832cb18c5edbb998cad14caf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\c43ebd87832cb18c5edbb998cad14caf.exe
  "C:\Users\Admin\AppData\Local\Temp\c43ebd87832cb18c5edbb998cad14caf.exe"
  2⤵
  - Checks BIOS information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-0-0x0000000000400000-0x0000000000A17000-memory.dmp

Filesize
6.1MB

Download
memory/1872-2-0x00000000029C0000-0x0000000002FD7000-memory.dmp

Filesize
6.1MB

Download
memory/1872-14-0x0000000000400000-0x0000000000A17000-memory.dmp

Filesize
6.1MB

Download
memory/2360-1-0x0000000000400000-0x0000000000A17000-memory.dmp

Filesize
6.1MB

Download
memory/2360-9-0x0000000000220000-0x0000000000276000-memory.dmp

Filesize
344KB

Download
memory/2360-4-0x0000000000220000-0x0000000000276000-memory.dmp

Filesize
344KB

Download
memory/2360-3-0x0000000000400000-0x0000000000A17000-memory.dmp

Filesize
6.1MB

Download
memory/2360-11-0x0000000000400000-0x0000000000A17000-memory.dmp

Filesize
6.1MB

Download
memory/2360-12-0x0000000000400000-0x0000000000A17000-memory.dmp

Filesize
6.1MB

Download
memory/2360-10-0x0000000000400000-0x0000000000A17000-memory.dmp

Filesize
6.1MB

Download
memory/2360-13-0x0000000000400000-0x0000000000A17000-memory.dmp

Filesize
6.1MB

Download
memory/2360-15-0x0000000000220000-0x0000000000276000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing