92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507

General

Target

92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
Size

4.9MB
MD5

2432959859676d10cb044fd0e9b30eb6
SHA1

eccb16289a993255d297824d6739186a13d901b3
SHA256

92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507
SHA512

faa0057cb39e7cab790904b5e924c5c077028afb383e324fa3e71f1f26f704b82e8bb27ee2052a58a55b422d0fa7de337539ad13bca00d8f5e177f255219070d
SSDEEP

49152:s57a+tCuJMXWIWtgkxArL5k3Qyv4UE3sliiDOa5tlhaIeANhW1X+ihKf:sXCu+NglZOa5tlhJeAnW1HKf

Score

7^/10

discovery

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\bios	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3020	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
3020	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
3020	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
3020	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3020	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3020	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
3020	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
3020	92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe

C:\Users\Admin\AppData\Local\Temp\92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe
"C:\Users\Admin\AppData\Local\Temp\92cdb4a0b59e47d4878945b02b2fe92767b8d6b01fdfda5f82253215fe90a507.exe"
1⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3020-0-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/3020-3-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/3020-2-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/3020-1-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/3020-4-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/3020-5-0x00000000003D0000-0x00000000003D2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads