Analysis
-
max time kernel
3s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-03-2021 23:08
General
-
Target
16937c50e9597e6d3ce66dc15632eee53ad10c32bb077d53baf0c4368b8a359a.exe
-
Size
4.3MB
-
MD5
a9db364c68ce56a448ead48291fa0cd3
-
SHA1
1550491d8a926cbabbd5dc963a4f41dd3b5b6826
-
SHA256
16937c50e9597e6d3ce66dc15632eee53ad10c32bb077d53baf0c4368b8a359a
-
SHA512
84b46388ffbe733c0ad9472ed0d811db1affa7ec3b6b218cf0f90a9685d2dfe55e7bf37194af147ae555315c5fa6ee00fcc98a8dad5cfd80120e178433e5db1f
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\16937c50e9597e6d3ce66dc15632eee53ad10c32bb077d53baf0c4368b8a359a.exe"C:\Users\Admin\AppData\Local\Temp\16937c50e9597e6d3ce66dc15632eee53ad10c32bb077d53baf0c4368b8a359a.exe"1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1908-2-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/1908-5-0x0000000004ED0000-0x0000000004EE1000-memory.dmpFilesize
68KB
-
memory/1908-4-0x0000000004AC0000-0x0000000004AD1000-memory.dmpFilesize
68KB