Overview

overview

10

Static

static

144755cf70...72.exe

windows7_x64

10

144755cf70...72.exe

windows10_x64

9

Analysis

  • max time kernel
    15s
  • max time network
    115s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-01-2021 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    144755cf70a3ef6c0212c49645891c53ce926ad7e3e626016023d6aecc484372.exe

Score
9/10
evasion

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Executes dropped EXE 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 44 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\144755cf70a3ef6c0212c49645891c53ce926ad7e3e626016023d6aecc484372.exe
    "C:\Users\Admin\AppData\Local\Temp\144755cf70a3ef6c0212c49645891c53ce926ad7e3e626016023d6aecc484372.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:616
    • C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\vruns.exe
      "C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\vruns.exe"
      2⤵
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:644
    • C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\intervpnmix2.exe
      "C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\intervpnmix2.exe"
      2⤵
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:1156

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\intervpnmix2.exe
    MD5

    e9eb8d2f63357b49faf245057fdc66d1

    SHA1

    3ff0a75822d6f351fb6ab1f3efe894db9ce3f0f1

    SHA256

    3ec68f4ebe52f084c10fa533d260beec237f5cb40ac2d7ce0e77860bce8f41e5

    SHA512

    14da458ac137a62c1125ed9e2d9c0501d183cc6a948bed82d2d46c449880304a8b7adda32e30caf9b4404eb8b3a16e51b9d3e8e35f0a67bf34e9ff96335c7f81

    Download Submit
  • C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\vruns.exe
    MD5

    1490ea3019282b9fd5825bfd6f73b1cf

    SHA1

    fa2c9a028db4dd83fa80fef8c90ca2bf34dc881d

    SHA256

    8f01777956479851c4c5dd06845ba0d4561b2a085472460447d10b46d4b89487

    SHA512

    bdf82235c3a3b94360c4e2507c6adb07d1731fff16b9d9038f9faed34ee55d60b70d9ca24a2f2baba7fcd4c95716d52590ed62a7802c068a8ae35d5213dfaced

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsq94B5.tmp\UAC.dll
    MD5

    adb29e6b186daa765dc750128649b63d

    SHA1

    160cbdc4cb0ac2c142d361df138c537aa7e708c9

    SHA256

    2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    SHA512

    b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    Download Submit
  • memory/644-3-0x0000000000000000-mapping.dmp
    Download
  • memory/644-8-0x0000000004790000-0x0000000004791000-memory.dmp
    Filesize

    4KB

    Download
  • memory/644-10-0x0000000004F90000-0x0000000004F91000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1156-5-0x0000000000000000-mapping.dmp
    Download
  • memory/1156-9-0x000000000A0D0000-0x000000000A0D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1156-7-0x00000000098D0000-0x00000000098D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1156-11-0x00000000098D0000-0x00000000098D1000-memory.dmp
    Filesize

    4KB

    Download