d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde

Analysis

max time kernel
120s
max time network
151s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde.exe
Size

202KB
MD5

0eec25556e12272aec614eb1e378450f
SHA1

a17b4f7192a0c8b9aebd416e271604d21cac460f
SHA256

d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde
SHA512

9967c3487e8890a5c5302568c58a9b3de2cfa3f29b392e7acf0bf889f6935ea57355477b82b824f12c4968f5ce34ade0e7f38018405b969b1b3cf264cc022b3b
SSDEEP

6144:Y9exgHUj3xw23jtMeX4vdBuF0dGCWZVonp:YAxgHUj3xwmjtMeX4VBuF0dG52

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1952	d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde.exe
1952	d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde.exe

C:\Users\Admin\AppData\Local\Temp\d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde.exe
"C:\Users\Admin\AppData\Local\Temp\d36df3275ee66ce34ff4cd4ad8550b5d2730306dfd05479f6d03627f6d976cde.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads