Overview

overview

9

Static

static

67c5cab06e...79.exe

windows7_x64

9

67c5cab06e...79.exe

windows10_x64

9

Analysis

  • max time kernel
    60s
  • max time network
    121s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    13-01-2021 12:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe

  • Size

    622KB

  • MD5

    26bdf798d94b9a8cde3a7baf41c119c7

  • SHA1

    54583e962e90d5af8ab1f5d2dd43284dc5ee88c3

  • SHA256

    67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679

  • SHA512

    13f9baad5e0b929757ab2baad1e8c599c4f8974899aceaa8852784558f3676458000b2de4ffc0e2e37393989a52084590c0cc586fea47a1f8e7d238bba2b0f6c

Score
9/10
evasion

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe
    "C:\Users\Admin\AppData\Local\Temp\67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 1288
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1368-2-0x0000000000000000-mapping.dmp
    Download
  • memory/1368-3-0x0000000002800000-0x0000000002801000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1368-4-0x0000000002800000-0x0000000002801000-memory.dmp
    Filesize

    4KB

    Download