301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f

General

Target

301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
Size

11.4MB
MD5

30a9676d1b2dfb37952d72b53c19551f
SHA1

3029af67a6cecb74dc9c85f42d4308d0924a6ff6
SHA256

301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f
SHA512

e65120f899d2634521ebbadca09716c3297bc194dd36238e9900ad9f3f0c27a74ff6d220d7d1437ee6beab1a8eef0d572df27d54f70db07ee866ffb5d596d7a8
SSDEEP

196608:8Fl5poKEGK54nLHXD4oOVqMBfOo6eU7iayz+r83k8EzBnMpAf2FaqxN08AE:8rTEy3cVqMdaiayZkBzBiAeFagN0w

Score

7^/10

upx

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1988-23-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral1/memory/1988-22-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral1/memory/1988-24-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral1/memory/1988-20-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral1/memory/1988-25-0x0000000000400000-0x0000000000F23040-memory.dmp	upx
behavioral1/memory/1988-29-0x0000000000400000-0x0000000000F23040-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\P:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\X:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\Z:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\E:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\M:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\W:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\Q:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\R:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\T:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\H:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\I:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\J:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\K:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\L:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\V:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\Y:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\G:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\N:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\S:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
File opened (read-only)	\??\U:	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28
PID 2040 wrote to memory of 1988	2040	301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe	28

C:\Users\Admin\AppData\Local\Temp\301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
"C:\Users\Admin\AppData\Local\Temp\301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
  C:\Users\Admin\AppData\Local\Temp\301e46e1e20bff126a72a7b62279a5a5a20eb0db9bac8251470ac685ae57468f.exe
  2⤵
  - Checks BIOS information in registry
  - Enumerates connected drives
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\luls.pk

Filesize
4.4MB

MD5
e85716eb2fb2587c45b46c4aaac5636b

SHA1
43cb8934ce5aa275f0644533030f2f5db24b57ab

SHA256
421147720f4897db9fbd9216f62f7e2bcc7c4c8c0eb89e0c274a71b149606d15

SHA512
04d4002fc8664396499df79b7de785dc62e3362e03cfdef9bef9c0179ffd382d7d1815d2555d214a4d544d3b8643594be8076a893c12857a8a3465fc6ca36098

Download Submit
C:\Users\Admin\AppData\Local\Temp\temps.temp

Filesize
3.5MB

MD5
142a46a7585fc54b4ac46c43a0645bd2

SHA1
ff64ba0726cdd038f57b84a18e656640106b7887

SHA256
5ac74c3b17ba519f9f59355aa854b529f6c046bee53859dbbf8a60d772827101

SHA512
1275c9f0b7c2b2f35a915b4347625550bce0526d3e43134a9b97f7ae4b0e4de70d0415301d988c6a1440d39ef2baeaaf0741b613b5ca599255598d0ae6e4341a

Download Submit
memory/1988-6-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/1988-20-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/1988-11-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/1988-29-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/1988-4-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1988-25-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/1988-12-0x00000000001D0000-0x00000000002EA000-memory.dmp

Filesize
1.1MB

Download
memory/1988-26-0x0000000000912000-0x0000000000F24000-memory.dmp

Filesize
6.1MB

Download
memory/1988-13-0x00000000001D0000-0x00000000002EA000-memory.dmp

Filesize
1.1MB

Download
memory/1988-21-0x0000000000912000-0x0000000000F24000-memory.dmp

Filesize
6.1MB

Download
memory/1988-23-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/1988-22-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/1988-24-0x0000000000400000-0x0000000000F23040-memory.dmp

Filesize
11.1MB

Download
memory/2040-1-0x0000000000400000-0x0000000001D74000-memory.dmp

Filesize
25.5MB

Download
memory/2040-18-0x0000000000400000-0x0000000001D74000-memory.dmp

Filesize
25.5MB

Download
memory/2040-16-0x0000000000400000-0x0000000001D74000-memory.dmp

Filesize
25.5MB

Download
memory/2040-0-0x0000000000400000-0x0000000001D74000-memory.dmp

Filesize
25.5MB

Download
memory/2040-30-0x0000000000400000-0x0000000001D74000-memory.dmp

Filesize
25.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads