53f6790814ffde9dc0d0a64e4423e080bd836b24ca8a3075bb2fa4d3efa1c3b5

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92b62ba83d1dd9cd66b6f984317ef32b.exe
Size 70KB
Sample240605-c817rscg83
SHA256 53f6790814ffde9dc0d0a64e4423e080bd836b24ca8a3075bb2fa4d3efa1c3b5
MD5 92b62ba83d1dd9cd66b6f984317ef32b
SHA1 460144f46d3efdb8aa5549b39af45ac4eb9f4803
SHA512 02d58053b2423c0725318f9762f21d4ef327fcbd5a9a4c3a9486a61d20e5cf2db236cf361cc807c63b2bf512970ee0047d69e9c0cd6937d96ecb190b76a06936
SSDEEP 1536:iZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:pd5BJHMqqDL2/Ovvdr
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hqkozpbilgy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\92b62ba83d1dd9cd66b6f984317ef32b.exe"	92b62ba83d1dd9cd66b6f984317ef32b.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\U:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\Y:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\A:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\H:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\I:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\O:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\P:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\G:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\J:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\L:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\T:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\V:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\W:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\X:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\B:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\E:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\K:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\N:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\R:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\Z:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\M:	92b62ba83d1dd9cd66b6f984317ef32b.exe
File opened (read-only)	\??\Q:	92b62ba83d1dd9cd66b6f984317ef32b.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	92b62ba83d1dd9cd66b6f984317ef32b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	92b62ba83d1dd9cd66b6f984317ef32b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	92b62ba83d1dd9cd66b6f984317ef32b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
864	92b62ba83d1dd9cd66b6f984317ef32b.exe
864	92b62ba83d1dd9cd66b6f984317ef32b.exe
864	92b62ba83d1dd9cd66b6f984317ef32b.exe
864	92b62ba83d1dd9cd66b6f984317ef32b.exe

C:\Users\Admin\AppData\Local\Temp\92b62ba83d1dd9cd66b6f984317ef32b.exe
"C:\Users\Admin\AppData\Local\Temp\92b62ba83d1dd9cd66b6f984317ef32b.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:2504