Analysis
- max time kernel
21s - max time network
135s - platform
windows10_x64 - resource
win10v20210410 - submitted
09/08/2021, 18:21
General
- Target cba619ceefd476c9cc3f35b5263e6276.exe
- Size 5.3MB
- Sample210809-dky64bezk6
- SHA256 69e7a10168bf96ba60f06987affd48857cd9cda1a518509f435b8b43110feacf
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cba619ceefd476c9cc3f35b5263e6276.exe"C:\Users\Admin\AppData\Local\Temp\cba619ceefd476c9cc3f35b5263e6276.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 508 -s 10802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/508-115-0x00007FF634E40000-0x00007FF634E41000-memory.dmp
memory/508-118-0x00007FF980030000-0x00007FF980031000-memory.dmp
memory/508-117-0x00007FF980000000-0x00007FF980002000-memory.dmp