Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07/06/2024, 16:29
Behavioral task
behavioral1
Sample
64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe
Resource
win10v2004-20240426-en
General
-
Target
64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe
-
Size
4.6MB
-
MD5
eebb29dd37ddf93ff68f748033e5e44a
-
SHA1
889c5d966cab0bfa5e194fd798c4d63e3d0d1df6
-
SHA256
64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a
-
SHA512
61e82030e4ddf5074f4209e2baf2d1bd35409035692de95fb1f98b27b6a37270e4cf7e8e3c0927783e8d26b6e7322cd1f6b658bd1893d97a5878b6313a995a92
-
SSDEEP
98304:u/Oo+mlt1Sqv0WYLAx/gGAb3EnAGEB+sh5DaCsUVjkCRE0+eaxFkUP:ro+evTP2vGIUAD+K5DaoVjlRE0DCnP
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2620-0-0x0000000000400000-0x0000000000F24000-memory.dmp upx behavioral1/memory/2620-1-0x0000000000400000-0x0000000000F24000-memory.dmp upx behavioral1/memory/2620-4-0x0000000000400000-0x0000000000F24000-memory.dmp upx -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\N: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\P: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\T: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\U: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\V: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\G: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\H: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\Q: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\R: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\S: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\K: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\L: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\O: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\X: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\Z: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\E: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\I: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\J: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\M: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe File opened (read-only) \??\W: 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion 64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe"C:\Users\Admin\AppData\Local\Temp\64e7bbca59c1b0b4d977ea5e497ddc4c91fa88a75259523d87872e0ddd06dc4a.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
PID:2620