67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679

General

Target

67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe
Size

622KB
MD5

26bdf798d94b9a8cde3a7baf41c119c7
SHA1

54583e962e90d5af8ab1f5d2dd43284dc5ee88c3
SHA256

67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679
SHA512

13f9baad5e0b929757ab2baad1e8c599c4f8974899aceaa8852784558f3676458000b2de4ffc0e2e37393989a52084590c0cc586fea47a1f8e7d238bba2b0f6c

Score

9^/10

evasion

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

Processes:

67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe

description	pid	process	target process
PID 336 wrote to memory of 1456	336	67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe	dw20.exe
PID 336 wrote to memory of 1456	336	67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe	dw20.exe
PID 336 wrote to memory of 1456	336	67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe	dw20.exe
PID 336 wrote to memory of 1456	336	67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe	dw20.exe