Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/06/2024, 00:24
Static task
static1
Behavioral task
behavioral1
Sample
1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe
Resource
win10v2004-20240226-en
General
-
Target
1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe
-
Size
4.8MB
-
MD5
3b5f9e3e43d8f1e50f1e82d2b804c8ab
-
SHA1
b20230b7c17ac3a8e7c5500a036559cc09ccb998
-
SHA256
1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51
-
SHA512
5a5ad9e5022f24ba4b90f0f2d64e1fe72b3d505b90ad9eb135da38752393fdea1fdc10c8d3411e6cd4e0fa389bd7b377aceb638d97dae5d4d5ffe2bbb832b4f1
-
SSDEEP
98304:F3Wv10cIHpT1OOEnoMbH82h6hxg0JaVw35rF7zutjJPeOf:de/yTInoQcGW/JaEF7zutsOf
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\M: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\N: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\Q: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\R: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\E: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\H: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\J: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\V: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\Z: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\W: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\X: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\A: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\O: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\P: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\B: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\L: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\Y: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\T: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\U: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\G: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\I: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe File opened (read-only) \??\S: 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion 1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe"C:\Users\Admin\AppData\Local\Temp\1424a50cfc597a60a7db0c894b1f8b4d74e4c86be151479a7850cddafdbccb51.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
PID:832