893ef71a58da9c450161aa56fddb97cd0e9c377f94a55e1d71a42569ee085de3

Analysis

max time kernel
140s
max time network
142s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VGM-SONAE-33714657_PDF.exe
Size 92KB
Sample201109-e3qdkj9856
SHA256 893ef71a58da9c450161aa56fddb97cd0e9c377f94a55e1d71a42569ee085de3
MD5 bbef2e61308d0e0b15af08fc65852ce6
SHA1 55e6eb2373bba84a5ccf785c58b293b880b1d7a4
SHA512 bc9013c3ea957b65cd6911a80b1d92b107dc7e838cd4e2ba979a2f095d23f72adebbb719341362ba79590bbbd8ed33f672e3581aa19e99aeafca135c2db9329f
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks QEMU agent state file 2 TTPs 1 IoCs

Checks state file used by QEMU agent, possibly to detect virtualization.

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\ProgramData\qemu-ga\qga.state	VGM-SONAE-33714657_PDF.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
416	VGM-SONAE-33714657_PDF.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
416	VGM-SONAE-33714657_PDF.exe

C:\Users\Admin\AppData\Local\Temp\VGM-SONAE-33714657_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\VGM-SONAE-33714657_PDF.exe"
1⤵
- Checks QEMU agent state file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads