Overview

overview

9

Static

static

PAK452431.exe

windows7_x64

9

PAK452431.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PAK452431.exe

  • Size

    661KB

  • Sample

    200707-fb6cwll49e

  • MD5

    1bbfcc115bf97ec1d010b3b9f1ad34b9

  • SHA1

    2e405d2142fb937bb8fcb3c71aa6f192e863d40c

  • SHA256

    e60131e245aac591c455594f208de438d18da96de8cd08c4990c973c7956c38f

  • SHA512

    7f69595b050cdb5f5f93078c0a843cbe3d7b8ff5af2be90b5927ff0098ea5bd86cf5948d3ac05ad4c8a6a23c69db3c9e4c352621fb48afb26b875bb73c63b513

Score
9/10

Malware Config

Targets

    • Target

      PAK452431.exe

    • Size

      661KB

    • MD5

      1bbfcc115bf97ec1d010b3b9f1ad34b9

    • SHA1

      2e405d2142fb937bb8fcb3c71aa6f192e863d40c

    • SHA256

      e60131e245aac591c455594f208de438d18da96de8cd08c4990c973c7956c38f

    • SHA512

      7f69595b050cdb5f5f93078c0a843cbe3d7b8ff5af2be90b5927ff0098ea5bd86cf5948d3ac05ad4c8a6a23c69db3c9e4c352621fb48afb26b875bb73c63b513

    Score
    9/10

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks