Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 14:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
peak.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
peak.exe
-
Size
3.7MB
-
MD5
eebe3fd6720cabdc477076f054829907
-
SHA1
f6056e84297b63c4cdaa5646697492d5705c9080
-
SHA256
7156621a3971908023b30ff150f96f72e9cd757dd0be4b514721c0e688c845cb
-
SHA512
00572e876baa9884e11875e3ef1e4d39a793c1165ffa5c98d8a753c1257f38791fda178483e0693826eff02cba7e8e0ae4b8a979bc505ab33ba763b002c72261
-
SSDEEP
98304:6wyZ0Cj88wMfPwozf3xdhdFUkGETCyukykgV8ja:699bftT3vhA4CyakgV8O
Score
9/10
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
peak.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions peak.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
peak.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools peak.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
peak.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion peak.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion peak.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
peak.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum peak.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 peak.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2892-0-0x00000000009D0000-0x0000000000D96000-memory.dmpFilesize
3.8MB
-
memory/2892-1-0x00000000744E0000-0x0000000074BCE000-memory.dmpFilesize
6.9MB
-
memory/2892-2-0x0000000004AE0000-0x0000000004B20000-memory.dmpFilesize
256KB
-
memory/2892-3-0x0000000006280000-0x0000000006606000-memory.dmpFilesize
3.5MB
-
memory/2892-4-0x00000000744E0000-0x0000000074BCE000-memory.dmpFilesize
6.9MB
-
memory/2892-5-0x0000000004AE0000-0x0000000004B20000-memory.dmpFilesize
256KB