745231b114be9c085ecbe47d390dcaf2d7756af6f73705e92bc79028dd1a6d63

General

Target

Detection (hwl).exe
Size

4.9MB
MD5

8e4a5b6ab6391d226e9114161b276f40
SHA1

1c70a1c8f796ca24c90e27c01cbf73e2bc1dc09d
SHA256

745231b114be9c085ecbe47d390dcaf2d7756af6f73705e92bc79028dd1a6d63
SHA512

8bdb8c572870abacf4f61bfc2bbb9d8e820387242d2b3ee07494072d14160cd501245af09f8618a790af991f3a3d03b172be68291fb7f86d3d31238a5733d2cf
SSDEEP

49152:Wm7UEpEucDlO5Z/e0k6KU+e69qSr9MlGwxFRnsB5XuAjJIoJgsbtEVjwEriD602N:HZi6DNkU5VnsB5XuhsMJOr2SRj4

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Detection (hwl).exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	Detection (hwl).exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	Detection (hwl).exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	Detection (hwl).exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Detection (hwl).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	Detection (hwl).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Detection (hwl).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Detection (hwl).exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	Detection (hwl).exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID	Detection (hwl).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	Detection (hwl).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Detection (hwl).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Detection (hwl).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Detection (hwl).exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\bios	Detection (hwl).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	Detection (hwl).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\	Detection (hwl).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Detection (hwl).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	Detection (hwl).exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1828	Detection (hwl).exe
1828	Detection (hwl).exe
1828	Detection (hwl).exe
1828	Detection (hwl).exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1828	Detection (hwl).exe
Token: SeCreatePagefilePrivilege	1828	Detection (hwl).exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1828	Detection (hwl).exe
1828	Detection (hwl).exe
1828	Detection (hwl).exe

C:\Users\Admin\AppData\Local\Temp\Detection (hwl).exe
"C:\Users\Admin\AppData\Local\Temp\Detection (hwl).exe"
1⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

5

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1828-0-0x000001B64ED10000-0x000001B64ED11000-memory.dmp

Filesize
4KB

Download
memory/1828-1-0x000001B64ED10000-0x000001B64ED11000-memory.dmp

Filesize
4KB

Download
memory/1828-2-0x000001B64ED10000-0x000001B64ED11000-memory.dmp

Filesize
4KB

Download
memory/1828-7-0x000001B64ED10000-0x000001B64ED11000-memory.dmp

Filesize
4KB

Download
memory/1828-12-0x000001B64ED10000-0x000001B64ED11000-memory.dmp

Filesize
4KB

Download
memory/1828-11-0x000001B64ED10000-0x000001B64ED11000-memory.dmp

Filesize
4KB

Download
memory/1828-10-0x000001B64ED10000-0x000001B64ED11000-memory.dmp

Filesize
4KB

Download
memory/1828-9-0x000001B64ED10000-0x000001B64ED11000-memory.dmp

Filesize
4KB

Download
memory/1828-8-0x000001B64ED10000-0x000001B64ED11000-memory.dmp

Filesize
4KB

Download
memory/1828-6-0x000001B64ED10000-0x000001B64ED11000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads