Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
04-07-2024 21:10
General
-
Target
a573205f27cd8a421e33322a41037ddf74d4f9cedc574c86dea6550a8f065143.exe
-
Size
2.5MB
-
MD5
8611a0d47266ce8d473d540bd6534ffc
-
SHA1
8804544c8ac023d89783d3d27b8c00b11dd8cbb4
-
SHA256
a573205f27cd8a421e33322a41037ddf74d4f9cedc574c86dea6550a8f065143
-
SHA512
8f4291ebb1b8cb5561b857d3ea2418c503f79b37b201f017d04a3c49746bfdc29abad5cfef3f2ce150fa8163824ac0a649a24386aee4562940d394f6514e4b7c
-
SSDEEP
49152:OE8I6oEK7uzgRTvnFjStQyfvE0Z3R0nxiIq2dseYGfXH:OE8IjzuzgFt7KtQRq2VXH
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a573205f27cd8a421e33322a41037ddf74d4f9cedc574c86dea6550a8f065143.exe"C:\Users\Admin\AppData\Local\Temp\a573205f27cd8a421e33322a41037ddf74d4f9cedc574c86dea6550a8f065143.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow