a29158eb8d65435a7f87236ded4e06cc5a53887f53bb4d8b6684350d636d2e00

Analysis

max time kernel
139s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/PresentMon/PresentMon-1.6.0-x64.exe
Size

444KB
MD5

8b6603deb94dc3d3209e5107886da308
SHA1

e9b9b53fec93edc60da33727e37f33a7164a1441
SHA256

b9dc19a5bbcd3c1a281ffb90f9926165baf0e7a0a74bd2b1e5a2dfa7a317042b
SHA512

51074eb46ad9c70c808085ff092d155fb432c707d6c8f9c85984baaf350087adccd35f38f16dcee3ac972271aa6ecc9a09c6a8cec00eb3e4357bacffec314fb7
SSDEEP

6144:YEvnPwHlG2CUOukoy/pxJFxD1Ngh2WYLOIeGzyXOmdFf5ILgh7uSXF31Om1lgH1N:EG2CKkBJq2WGOIeTHnh7NE

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

PresentMon-1.6.0-x64.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PresentMon-1.6.0-x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	PresentMon-1.6.0-x64.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PresentMon-1.6.0-x64.exe

description pid process

Token: SeDebugPrivilege 4860 PresentMon-1.6.0-x64.exe

description	pid	process
Token: SeDebugPrivilege	4860	PresentMon-1.6.0-x64.exe

C:\Users\Admin\AppData\Local\Temp\bin\PresentMon\PresentMon-1.6.0-x64.exe
"C:\Users\Admin\AppData\Local\Temp\bin\PresentMon\PresentMon-1.6.0-x64.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3240,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:8
1⤵
PID:4324

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads