e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e

General

Target
e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe
Size 947KB
Sample201111-9vask2wnjs
SHA256 e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e
MD5 1316a068968384cfe539b48183fbb457
SHA1 2b26c1b1a25eb184f74056a67e8b4a7fd2ac8539
SHA512 9d458215db71066076337ff4379df011e13861419e4653204a449c25c6817966285370af868ecafae274fdb821beb67e1b1d6592a162b96835e6904b2a75bea3
MD5 SHA1 SHA512

Score

9^/10

evasion

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 788	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	32

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
788	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe
788	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	788	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 732	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	30
PID 1756 wrote to memory of 732	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	30
PID 1756 wrote to memory of 732	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	30
PID 1756 wrote to memory of 732	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	30
PID 1756 wrote to memory of 788	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	32
PID 1756 wrote to memory of 788	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	32
PID 1756 wrote to memory of 788	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	32
PID 1756 wrote to memory of 788	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	32
PID 1756 wrote to memory of 788	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	32
PID 1756 wrote to memory of 788	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	32
PID 1756 wrote to memory of 788	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	32
PID 1756 wrote to memory of 788	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	32
PID 1756 wrote to memory of 788	1756	e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe	32

C:\Users\Admin\AppData\Local\Temp\e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe
"C:\Users\Admin\AppData\Local\Temp\e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cRofSelvxJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD327.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:732
- C:\Users\Admin\AppData\Local\Temp\e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\e6df1712da8913c307d5506b1cd848683ca9d21eba6201512bb6f01a87b59b2e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:788