Analysis
- max time kernel
154s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
15/03/2024, 00:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca060f682ba1a5312cefeddd77174756.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
General
- Target ca060f682ba1a5312cefeddd77174756.exe
- Size 332KB
- Sample240315-asmckadf86
- SHA256 0222fa199ccbb2065af7db6422a19e73eb6fbba1acb4f3fab104d0a4f4e7225e
- MD5 ca060f682ba1a5312cefeddd77174756
- SHA1 34224ff17cfc169ac1db7ed78afcccf12450091f
- SHA512 065210cecb8fcf6c51d92318145b40c09ac9c5c5b4cf3d6754640af8f196a1dc5fbeecc9da2316725e4f817f490bde07c81daa2d317221ee3510e76433760d58
- SSDEEP 6144:towE2D9v7YU8CEX/FpX+Rymmy4xQxVQbJenU1lXvARSNfoqUjYjEwxA:towDpTYUfe/mRDX4xQxVMJh1BAA9oVjW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate ca060f682ba1a5312cefeddd77174756.exe -
resource yara_rule behavioral2/memory/372-0-0x0000000013140000-0x00000000131FB000-memory.dmp upx behavioral2/memory/372-1-0x0000000013140000-0x00000000131FB000-memory.dmp upx behavioral2/memory/372-2-0x0000000013140000-0x00000000131FB000-memory.dmp upx behavioral2/memory/372-3-0x0000000013140000-0x00000000131FB000-memory.dmp upx behavioral2/memory/372-4-0x0000000013140000-0x00000000131FB000-memory.dmp upx behavioral2/memory/372-7-0x0000000013140000-0x00000000131FB000-memory.dmp upx behavioral2/memory/372-8-0x0000000013140000-0x00000000131FB000-memory.dmp upx behavioral2/memory/372-9-0x0000000013140000-0x00000000131FB000-memory.dmp upx - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2980 set thread context of 372 2980 ca060f682ba1a5312cefeddd77174756.exe 104 - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier ca060f682ba1a5312cefeddd77174756.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ca060f682ba1a5312cefeddd77174756.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ca060f682ba1a5312cefeddd77174756.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ca060f682ba1a5312cefeddd77174756.exe - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier ca060f682ba1a5312cefeddd77174756.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeSecurityPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeTakeOwnershipPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeLoadDriverPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeSystemProfilePrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeSystemtimePrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeProfSingleProcessPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeIncBasePriorityPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeCreatePagefilePrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeBackupPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeRestorePrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeShutdownPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeDebugPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeSystemEnvironmentPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeChangeNotifyPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeRemoteShutdownPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeUndockPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeManageVolumePrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeImpersonatePrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: SeCreateGlobalPrivilege 372 ca060f682ba1a5312cefeddd77174756.exe Token: 33 372 ca060f682ba1a5312cefeddd77174756.exe Token: 34 372 ca060f682ba1a5312cefeddd77174756.exe Token: 35 372 ca060f682ba1a5312cefeddd77174756.exe Token: 36 372 ca060f682ba1a5312cefeddd77174756.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2980 wrote to memory of 372 2980 ca060f682ba1a5312cefeddd77174756.exe 104 PID 2980 wrote to memory of 372 2980 ca060f682ba1a5312cefeddd77174756.exe 104 PID 2980 wrote to memory of 372 2980 ca060f682ba1a5312cefeddd77174756.exe 104 PID 2980 wrote to memory of 372 2980 ca060f682ba1a5312cefeddd77174756.exe 104 PID 2980 wrote to memory of 372 2980 ca060f682ba1a5312cefeddd77174756.exe 104 PID 2980 wrote to memory of 372 2980 ca060f682ba1a5312cefeddd77174756.exe 104 PID 2980 wrote to memory of 372 2980 ca060f682ba1a5312cefeddd77174756.exe 104 PID 2980 wrote to memory of 372 2980 ca060f682ba1a5312cefeddd77174756.exe 104 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106 PID 372 wrote to memory of 3084 372 ca060f682ba1a5312cefeddd77174756.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca060f682ba1a5312cefeddd77174756.exe"C:\Users\Admin\AppData\Local\Temp\ca060f682ba1a5312cefeddd77174756.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\ca060f682ba1a5312cefeddd77174756.exe"C:\Users\Admin\AppData\Local\Temp\ca060f682ba1a5312cefeddd77174756.exe"2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe3⤵PID:3084
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4040 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:3352