7be1a27c42f1dd1703b4e35bb619ae44fe55c29abe8ad204bdc1cdd91e75e7a8

General

Target
gunzipped.exe
Size 525KB
Sample200716-xeaseayvs2
SHA256 7be1a27c42f1dd1703b4e35bb619ae44fe55c29abe8ad204bdc1cdd91e75e7a8
MD5 3a917a8551132d01bfa74f6bf855274e
SHA1 f3f922a95c53793217f7a0c3dd5f6879872d1db7
SHA512 898939ab0423885997bf17da2ba24a69f03389d70bf949acb07660fb0ea102762bde102535dc1123a37d30739e41d8c37e256d0ff10d2caa1ddaa0ebd36c3866
MD5 SHA1 SHA512

Score

9^/10

evasion

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	gunzipped.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	gunzipped.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
520	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 520	1400	gunzipped.exe	27
PID 1400 wrote to memory of 520	1400	gunzipped.exe	27
PID 1400 wrote to memory of 520	1400	gunzipped.exe	27
PID 1400 wrote to memory of 520	1400	gunzipped.exe	27
PID 1400 wrote to memory of 580	1400	gunzipped.exe	29
PID 1400 wrote to memory of 580	1400	gunzipped.exe	29
PID 1400 wrote to memory of 580	1400	gunzipped.exe	29
PID 1400 wrote to memory of 580	1400	gunzipped.exe	29
PID 1400 wrote to memory of 820	1400	gunzipped.exe	30
PID 1400 wrote to memory of 820	1400	gunzipped.exe	30
PID 1400 wrote to memory of 820	1400	gunzipped.exe	30
PID 1400 wrote to memory of 820	1400	gunzipped.exe	30
PID 1400 wrote to memory of 1300	1400	gunzipped.exe	31
PID 1400 wrote to memory of 1300	1400	gunzipped.exe	31
PID 1400 wrote to memory of 1300	1400	gunzipped.exe	31
PID 1400 wrote to memory of 1300	1400	gunzipped.exe	31
PID 1400 wrote to memory of 1196	1400	gunzipped.exe	32
PID 1400 wrote to memory of 1196	1400	gunzipped.exe	32
PID 1400 wrote to memory of 1196	1400	gunzipped.exe	32
PID 1400 wrote to memory of 1196	1400	gunzipped.exe	32
PID 1400 wrote to memory of 1492	1400	gunzipped.exe	33
PID 1400 wrote to memory of 1492	1400	gunzipped.exe	33
PID 1400 wrote to memory of 1492	1400	gunzipped.exe	33
PID 1400 wrote to memory of 1492	1400	gunzipped.exe	33

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	gunzipped.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	gunzipped.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	gunzipped.exe

C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
"C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Checks BIOS information in registry
PID:1400
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fYazAgQcXY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp86DB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:520
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "{path}"
  2⤵
  PID:580
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "{path}"
  2⤵
  PID:820
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "{path}"
  2⤵
  PID:1300
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "{path}"
  2⤵
  PID:1196
- C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
  "{path}"
  2⤵
  PID:1492