Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
15/03/2024, 02:20
Behavioral task
behavioral1
Sample
ca3c8120c663027aa447e2a26027ae7a.exe
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
General
- Target ca3c8120c663027aa447e2a26027ae7a.exe
- Size 658KB
- Sample240315-csj9baeb7w
- SHA256 7c899ba3e829541eff0cb3e06405e3f3b3d166d31dead2b212da4b93d97c56aa
- MD5 ca3c8120c663027aa447e2a26027ae7a
- SHA1 7aafa39e294348d67e7aba09d678a85e02298cdc
- SHA512 7b142da531d0d08c3384656601bd9b8cd5cc22e0cd16e0fb03ffbc4c80a6e848c5706d0867431f2ecc2d980d3561947eae8f61be986640f99af46f34aa012252
- SSDEEP 12288:x9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKt0:HAQ6Zx9cxTmOrucTIEFSpOGX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate ca3c8120c663027aa447e2a26027ae7a.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3760 set thread context of 2812 3760 ca3c8120c663027aa447e2a26027ae7a.exe 88 - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier ca3c8120c663027aa447e2a26027ae7a.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ca3c8120c663027aa447e2a26027ae7a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ca3c8120c663027aa447e2a26027ae7a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ca3c8120c663027aa447e2a26027ae7a.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier ca3c8120c663027aa447e2a26027ae7a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeSecurityPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeTakeOwnershipPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeLoadDriverPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeSystemProfilePrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeSystemtimePrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeProfSingleProcessPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeIncBasePriorityPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeCreatePagefilePrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeBackupPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeRestorePrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeShutdownPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeDebugPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeSystemEnvironmentPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeChangeNotifyPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeRemoteShutdownPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeUndockPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeManageVolumePrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeImpersonatePrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeCreateGlobalPrivilege 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: 33 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: 34 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: 35 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: 36 3760 ca3c8120c663027aa447e2a26027ae7a.exe Token: SeIncreaseQuotaPrivilege 2812 explorer.exe Token: SeSecurityPrivilege 2812 explorer.exe Token: SeTakeOwnershipPrivilege 2812 explorer.exe Token: SeLoadDriverPrivilege 2812 explorer.exe Token: SeSystemProfilePrivilege 2812 explorer.exe Token: SeSystemtimePrivilege 2812 explorer.exe Token: SeProfSingleProcessPrivilege 2812 explorer.exe Token: SeIncBasePriorityPrivilege 2812 explorer.exe Token: SeCreatePagefilePrivilege 2812 explorer.exe Token: SeBackupPrivilege 2812 explorer.exe Token: SeRestorePrivilege 2812 explorer.exe Token: SeShutdownPrivilege 2812 explorer.exe Token: SeDebugPrivilege 2812 explorer.exe Token: SeSystemEnvironmentPrivilege 2812 explorer.exe Token: SeChangeNotifyPrivilege 2812 explorer.exe Token: SeRemoteShutdownPrivilege 2812 explorer.exe Token: SeUndockPrivilege 2812 explorer.exe Token: SeManageVolumePrivilege 2812 explorer.exe Token: SeImpersonatePrivilege 2812 explorer.exe Token: SeCreateGlobalPrivilege 2812 explorer.exe Token: 33 2812 explorer.exe Token: 34 2812 explorer.exe Token: 35 2812 explorer.exe Token: 36 2812 explorer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3760 wrote to memory of 2812 3760 ca3c8120c663027aa447e2a26027ae7a.exe 88 PID 3760 wrote to memory of 2812 3760 ca3c8120c663027aa447e2a26027ae7a.exe 88 PID 3760 wrote to memory of 2812 3760 ca3c8120c663027aa447e2a26027ae7a.exe 88 PID 3760 wrote to memory of 2812 3760 ca3c8120c663027aa447e2a26027ae7a.exe 88 PID 3760 wrote to memory of 2812 3760 ca3c8120c663027aa447e2a26027ae7a.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca3c8120c663027aa447e2a26027ae7a.exe"C:\Users\Admin\AppData\Local\Temp\ca3c8120c663027aa447e2a26027ae7a.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2812
-