Overview

overview

9

Static

static

474.exe

windows7_x64

9

474.exe

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    474.exe

  • Size

    845KB

  • Sample

    210421-4g1rk3621e

  • MD5

    f2f999b1c9da0384ccdd00026b3d0ba8

  • SHA1

    056ca710061ee026713449f1112eccb3bb886308

  • SHA256

    f4278e648ad9a503db7277fa359416d478084074725e6546d5065936cae79a45

  • SHA512

    9e6e91eb0c78a2a990f74dead3c120194228e2b90575c685b8fec8f951a15ebc86502edaec6b28b8ed306728e793fdbb759a01dacb9dc158e8879c5d286f56ac

Score
9/10
evasion

Malware Config

Targets

    • Target

      474.exe

    • Size

      845KB

    • MD5

      f2f999b1c9da0384ccdd00026b3d0ba8

    • SHA1

      056ca710061ee026713449f1112eccb3bb886308

    • SHA256

      f4278e648ad9a503db7277fa359416d478084074725e6546d5065936cae79a45

    • SHA512

      9e6e91eb0c78a2a990f74dead3c120194228e2b90575c685b8fec8f951a15ebc86502edaec6b28b8ed306728e793fdbb759a01dacb9dc158e8879c5d286f56ac

    Score
    9/10
    evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks