f651cc333a00fe7574daf569d3e4d4dfab9909ee0a65d7b4085fb85e91223349

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f651cc333a00fe7574daf569d3e4d4dfab9909ee0a65d7b4085fb85e91223349.exe
Size

1.1MB
MD5

28c531a8bf4b497718847a64054194a3
SHA1

04fe25f7f8ebbe7d36cec6e1af77442629e169c4
SHA256

f651cc333a00fe7574daf569d3e4d4dfab9909ee0a65d7b4085fb85e91223349
SHA512

41d70ae0f77f435bd4f957ab382f015fd8d2d69ba5f04c6b93cb7aeb1445efbf02e0ee3063b0402d8a209ec8ed71a2b6945c864f5d6a0e70b42f89a65d888170
SSDEEP

12288:OYZU84uV5sd6X461Xo1XYwTLowTLAwTL/yHhZOMlrXhQUFBpo7TLK:5Ufu3sYFoFPTLTDTj25NATu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	f651cc333a00fe7574daf569d3e4d4dfab9909ee0a65d7b4085fb85e91223349.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	f651cc333a00fe7574daf569d3e4d4dfab9909ee0a65d7b4085fb85e91223349.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3024	f651cc333a00fe7574daf569d3e4d4dfab9909ee0a65d7b4085fb85e91223349.exe

C:\Users\Admin\AppData\Local\Temp\f651cc333a00fe7574daf569d3e4d4dfab9909ee0a65d7b4085fb85e91223349.exe
"C:\Users\Admin\AppData\Local\Temp\f651cc333a00fe7574daf569d3e4d4dfab9909ee0a65d7b4085fb85e91223349.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3024-0-0x0000000073EEE000-0x0000000073EEF000-memory.dmp

Filesize
4KB

Download
memory/3024-1-0x0000000000220000-0x0000000000334000-memory.dmp

Filesize
1.1MB

Download
memory/3024-2-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/3024-3-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/3024-4-0x0000000073EEE000-0x0000000073EEF000-memory.dmp

Filesize
4KB

Download
memory/3024-5-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/3024-6-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download