Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 17:19
Static task
static1
Behavioral task
behavioral1
Sample
PAK452431.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PAK452431.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
PAK452431.exe
-
Size
661KB
-
MD5
1bbfcc115bf97ec1d010b3b9f1ad34b9
-
SHA1
2e405d2142fb937bb8fcb3c71aa6f192e863d40c
-
SHA256
e60131e245aac591c455594f208de438d18da96de8cd08c4990c973c7956c38f
-
SHA512
7f69595b050cdb5f5f93078c0a843cbe3d7b8ff5af2be90b5927ff0098ea5bd86cf5948d3ac05ad4c8a6a23c69db3c9e4c352621fb48afb26b875bb73c63b513
Score
9/10
Malware Config
Signatures
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
PAK452431.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools PAK452431.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
PAK452431.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum PAK452431.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 PAK452431.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
PAK452431.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PAK452431.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PAK452431.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
PAK452431.exedescription pid process target process PID 1496 wrote to memory of 1032 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1032 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1032 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1032 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 732 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 732 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 732 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 732 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1520 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1520 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1520 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1520 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1508 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1508 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1508 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1508 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1484 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1484 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1484 1496 PAK452431.exe PAK452431.exe PID 1496 wrote to memory of 1484 1496 PAK452431.exe PAK452431.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PAK452431.exedescription pid process Token: SeDebugPrivilege 1496 PAK452431.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PAK452431.exepid process 1496 PAK452431.exe 1496 PAK452431.exe 1496 PAK452431.exe 1496 PAK452431.exe 1496 PAK452431.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
PAK452431.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions PAK452431.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAK452431.exe"C:\Users\Admin\AppData\Local\Temp\PAK452431.exe"1⤵
- Looks for VMWare Tools registry key
- Maps connected drives based on registry
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Looks for VirtualBox Guest Additions in registry
-
C:\Users\Admin\AppData\Local\Temp\PAK452431.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PAK452431.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PAK452431.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PAK452431.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PAK452431.exe"{path}"2⤵