4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f

General

Target
4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
Size 5.3MB
Sample240613-d7dkrashnf
SHA256 4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f
MD5 9e2aa4a89447b7e12d4e1df2bf223e85
SHA1 c69f6d161c7e88fa9eec70c1f25daf332ca59ca2
SHA512 cbb50fc220e91e2faf7cb0fc26136888082d283a03c2d3810fab8f6cd3c117e2e206162b477c7a6df3e719a7ab78c4bc1697e7018ada3540cea4a3ea9d1f49c2
SSDEEP 98304:kf4EIDDHK9nhCbJzEaokXvLZw8jzcO/7KNQS8r7NL5j5tDo3STwK7zUFBVEW1FG2:Q4HKDQBKkXy+XWt815j5tDobSUFQicRs
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\T:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\Y:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\U:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\W:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\E:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\G:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\H:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\K:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\L:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\S:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\B:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\M:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\N:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\P:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\V:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\Z:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\A:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\I:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\J:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\Q:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\R:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
File opened (read-only)	\??\X:	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe

C:\Users\Admin\AppData\Local\Temp\4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe
"C:\Users\Admin\AppData\Local\Temp\4a5b9363e552906be17b3fd95387af524002d06f585d47ba15a9ee50aecc635f.exe"
1⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
PID:2256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2564,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2256-1-0x0000000000D50000-0x0000000000D53000-memory.dmp

Download

memory/2256-0-0x0000000000400000-0x0000000000CB9000-memory.dmp

Download

memory/2256-2-0x0000000000400000-0x0000000000CB9000-memory.dmp

Download

memory/2256-3-0x0000000000400000-0x0000000000CB9000-memory.dmp

Download

memory/2256-4-0x0000000000401000-0x000000000053D000-memory.dmp

Download

memory/2256-5-0x0000000000400000-0x0000000000CB9000-memory.dmp

Download

memory/2256-6-0x0000000000400000-0x0000000000CB9000-memory.dmp

Download

memory/2256-8-0x0000000000401000-0x000000000053D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads