General
-
Target
WaterProject.exe
-
Size
5.4MB
-
Sample
220204-y38kjsfbbj
-
MD5
f2a57bb6758905eaca06a660c09b260a
-
SHA1
e4d7b16d17af272921436bddf3766894ab0084b1
-
SHA256
48cd84c3636a60624ed4055ac6276f0623c4f1313c1dc81060e15c58d9aec461
-
SHA512
228a934e3ca5600eb6e8252cbb7bf8bcacdadbcc301758725d1681cd0ff0aa7b0e1ff691a3f5fdcb6b906a9fa95a30be29ffec33375d1d69ac072ab17a9d551c
Static task
static1
Behavioral task
behavioral1
Sample
WaterProject.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
WaterProject.exe
Resource
win10v2004-en-20220112
Malware Config
Targets
-
-
Target
WaterProject.exe
-
Size
5.4MB
-
MD5
f2a57bb6758905eaca06a660c09b260a
-
SHA1
e4d7b16d17af272921436bddf3766894ab0084b1
-
SHA256
48cd84c3636a60624ed4055ac6276f0623c4f1313c1dc81060e15c58d9aec461
-
SHA512
228a934e3ca5600eb6e8252cbb7bf8bcacdadbcc301758725d1681cd0ff0aa7b0e1ff691a3f5fdcb6b906a9fa95a30be29ffec33375d1d69ac072ab17a9d551c
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-