524bd24b076dc2580ced18f98ee98ab54d528f5fc8ffe02bdda47fa557feeb3c

General

Target
NEW.00785.exe
Size 644KB
Sample210730-clsf586txe
SHA256 524bd24b076dc2580ced18f98ee98ab54d528f5fc8ffe02bdda47fa557feeb3c
MD5 e01a751a8d6a089d25eccf34c504a5b0
SHA1 58198c6cfa650df0609cb1dd931a59ebe6388d0f
SHA512 c83b57f3ae4340f74888a18a7d557157ae339934004febe871fe3df8c7245884b4038957a0487b3d85f52926b8f132284e0052e5017849c49c3103876267c7e0
MD5 SHA1 SHA512

Score

9^/10

evasion

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NEW.00785.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NEW.00785.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	NEW.00785.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	NEW.00785.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 1476	1652	NEW.00785.exe	31

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1488	dw20.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	NEW.00785.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1700	1652	NEW.00785.exe	30
PID 1652 wrote to memory of 1700	1652	NEW.00785.exe	30
PID 1652 wrote to memory of 1700	1652	NEW.00785.exe	30
PID 1652 wrote to memory of 1700	1652	NEW.00785.exe	30
PID 1652 wrote to memory of 1476	1652	NEW.00785.exe	31
PID 1652 wrote to memory of 1476	1652	NEW.00785.exe	31
PID 1652 wrote to memory of 1476	1652	NEW.00785.exe	31
PID 1652 wrote to memory of 1476	1652	NEW.00785.exe	31
PID 1652 wrote to memory of 1476	1652	NEW.00785.exe	31
PID 1652 wrote to memory of 1476	1652	NEW.00785.exe	31
PID 1652 wrote to memory of 1476	1652	NEW.00785.exe	31
PID 1652 wrote to memory of 1476	1652	NEW.00785.exe	31
PID 1652 wrote to memory of 1476	1652	NEW.00785.exe	31
PID 1476 wrote to memory of 1488	1476	NEW.00785.exe	32
PID 1476 wrote to memory of 1488	1476	NEW.00785.exe	32
PID 1476 wrote to memory of 1488	1476	NEW.00785.exe	32
PID 1476 wrote to memory of 1488	1476	NEW.00785.exe	32