b04cae9012dcc3ee5ba1010a1b57d6005bff3752596a39f606729bcd49e5fea6

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b04cae9012dcc3ee5ba1010a1b57d6005bff3752596a39f606729bcd49e5fea6.exe
Size

5.0MB
MD5

96ed7f257fc15f7e3649d966ae7dcb63
SHA1

9dfe8f68043028c25b8747181dd9805201647ff2
SHA256

b04cae9012dcc3ee5ba1010a1b57d6005bff3752596a39f606729bcd49e5fea6
SHA512

9bb2cfb5d426ad76647322518420947c39ca28eb4cfa11fab13e59d3ba23828507e564739118783404dcfd017a16b816a9d1a7bdcc52b5f165ff47045724fb07
SSDEEP

98304:t1+ULQo7a6+nthnD+ISMJ1U+EKo2DqboGGQMM8KYDZ6:jothnD+I8QubZGdrKYD

Score

9^/10

oss_ak

Malware Config

Signatures

detect oss ak 4 IoCs

oss ak information detected.

oss_ak

Processes:

resource	yara_rule
behavioral2/memory/2940-0-0x0000000000400000-0x000000000090A000-memory.dmp	detect_ak_stuff
behavioral2/memory/2940-2-0x0000000000400000-0x000000000090A000-memory.dmp	detect_ak_stuff
behavioral2/memory/2940-3-0x0000000000400000-0x000000000090A000-memory.dmp	detect_ak_stuff
behavioral2/memory/2940-5-0x0000000000400000-0x000000000090A000-memory.dmp	detect_ak_stuff

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b04cae9012dcc3ee5ba1010a1b57d6005bff3752596a39f606729bcd49e5fea6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b04cae9012dcc3ee5ba1010a1b57d6005bff3752596a39f606729bcd49e5fea6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

b04cae9012dcc3ee5ba1010a1b57d6005bff3752596a39f606729bcd49e5fea6.exe

pid process

2940 b04cae9012dcc3ee5ba1010a1b57d6005bff3752596a39f606729bcd49e5fea6.exe

pid	process
2940	b04cae9012dcc3ee5ba1010a1b57d6005bff3752596a39f606729bcd49e5fea6.exe

C:\Users\Admin\AppData\Local\Temp\b04cae9012dcc3ee5ba1010a1b57d6005bff3752596a39f606729bcd49e5fea6.exe
"C:\Users\Admin\AppData\Local\Temp\b04cae9012dcc3ee5ba1010a1b57d6005bff3752596a39f606729bcd49e5fea6.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2668,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
1⤵
PID:2848

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-1-0x0000000000869000-0x0000000000903000-memory.dmp

Filesize
616KB

Download
memory/2940-0-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download
memory/2940-2-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download
memory/2940-3-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download
memory/2940-5-0x0000000000400000-0x000000000090A000-memory.dmp

Filesize
5.0MB

Download