63641025af82b200f398d1895af42c06a6cf34d5d0b3634008fe8e1295226039

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ccd94c5fcbdd734ce21e2d18648aa564.exe
Size

523KB
MD5

ccd94c5fcbdd734ce21e2d18648aa564
SHA1

af214c2a2b1dd29c387a817109d20a211de2e0fa
SHA256

63641025af82b200f398d1895af42c06a6cf34d5d0b3634008fe8e1295226039
SHA512

50243db7f6144ea7ba219b7358eb8ca1e72309f52b31b0103aaec2c5cbc3363bb4937f18372b2433c2475b040e49b9a354a1da003ed8765a61901cb63cd0094e
SSDEEP

12288:u6cpfVGU0B3XGVZ86VpYj6tlmVJQex1YfiUJ6C:Spfcj3XGVZ864mRe7Y6UJF

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ccd94c5fcbdd734ce21e2d18648aa564.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ccd94c5fcbdd734ce21e2d18648aa564.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	ccd94c5fcbdd734ce21e2d18648aa564.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ty1804818721z.wxx	ccd94c5fcbdd734ce21e2d18648aa564.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\ty1804818721z.wxx\ = 4fa56c224fe5b3758ab2e146abe602a2	ccd94c5fcbdd734ce21e2d18648aa564.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2544	ccd94c5fcbdd734ce21e2d18648aa564.exe

C:\Users\Admin\AppData\Local\Temp\ccd94c5fcbdd734ce21e2d18648aa564.exe
"C:\Users\Admin\AppData\Local\Temp\ccd94c5fcbdd734ce21e2d18648aa564.exe"
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2544-0-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2544-6-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/2544-8-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads