fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba

General

Target

fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
Size

12.2MB
MD5

f69f7d42f82575a506e5ec6afad59f2a
SHA1

35eb1da2d74396e56dd98d7a934efce392d82aa3
SHA256

fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba
SHA512

88a6405f798913a0421df12bd0c504385467d35b38135b4f41a880f23a130acceff89b3ae91d128909b3d557133fc5a4910d32da0ec56589dbf2066a1660b341
SSDEEP

98304:8NTArXJd8sHRzozoAagFNFO5ukPHD344Lo3Adoskqq3pQWGhc1:CAT8sHRzoz8gFN05ua84U3tv3jR

Score

7^/10

upx

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-0-0x0000000000240000-0x000000000024B000-memory.dmp	upx
behavioral1/memory/2368-1-0x0000000000250000-0x000000000025B000-memory.dmp	upx
behavioral1/memory/2368-2-0x0000000000270000-0x0000000000278000-memory.dmp	upx
behavioral1/memory/2368-7-0x0000000000240000-0x000000000024B000-memory.dmp	upx
behavioral1/memory/2368-4-0x0000000000250000-0x000000000025B000-memory.dmp	upx

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\B:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\I:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\M:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\O:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\P:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\Y:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\Z:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\E:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\N:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\R:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\S:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\W:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\X:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\G:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\H:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\K:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\L:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\Q:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\T:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\U:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\V:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
File opened (read-only)	\??\A:	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
Token: SeDebugPrivilege	2368	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe

C:\Users\Admin\AppData\Local\Temp\fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe
"C:\Users\Admin\AppData\Local\Temp\fd9529a07c23cf530ba4f1768606ac771cfedcc95a4769357a5295435e17eaba.exe"
1⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-0-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/2368-1-0x0000000000250000-0x000000000025B000-memory.dmp

Filesize
44KB

Download
memory/2368-3-0x0000000000400000-0x0000000000F58000-memory.dmp

Filesize
11.3MB

Download
memory/2368-2-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/2368-7-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/2368-6-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2368-5-0x0000000000280000-0x0000000000287000-memory.dmp

Filesize
28KB

Download
memory/2368-4-0x0000000000250000-0x000000000025B000-memory.dmp

Filesize
44KB

Download
memory/2368-8-0x0000000000400000-0x0000000000F58000-memory.dmp

Filesize
11.3MB

Download
memory/2368-10-0x0000000000401000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2368-9-0x0000000000400000-0x0000000000F58000-memory.dmp

Filesize
11.3MB

Download
memory/2368-11-0x0000000000400000-0x0000000000F58000-memory.dmp

Filesize
11.3MB

Download
memory/2368-12-0x0000000000400000-0x0000000000F58000-memory.dmp

Filesize
11.3MB

Download
memory/2368-14-0x0000000000401000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads