Overview

overview

9

Static

static

1.exe

windows7_x64

9

1.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1.exe

  • Size

    622KB

  • Sample

    210113-psllvjyma6

  • MD5

    26bdf798d94b9a8cde3a7baf41c119c7

  • SHA1

    54583e962e90d5af8ab1f5d2dd43284dc5ee88c3

  • SHA256

    67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679

  • SHA512

    13f9baad5e0b929757ab2baad1e8c599c4f8974899aceaa8852784558f3676458000b2de4ffc0e2e37393989a52084590c0cc586fea47a1f8e7d238bba2b0f6c

Score
9/10
evasion

Malware Config

Targets

    • Target

      1.exe

    • Size

      622KB

    • MD5

      26bdf798d94b9a8cde3a7baf41c119c7

    • SHA1

      54583e962e90d5af8ab1f5d2dd43284dc5ee88c3

    • SHA256

      67c5cab06eb864d30cfed863f142fc4d80e3e324b7b30d46e37e38451f306679

    • SHA512

      13f9baad5e0b929757ab2baad1e8c599c4f8974899aceaa8852784558f3676458000b2de4ffc0e2e37393989a52084590c0cc586fea47a1f8e7d238bba2b0f6c

    Score
    9/10
    evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks