Analysis
-
max time kernel
41s -
max time network
42s -
platform
windows10_x64 -
resource
win10-de-20211208 -
submitted
14-02-2022 15:18
General
-
Target
airplane.wtf.exe
-
Size
3.8MB
-
MD5
fb1e695f13801baad5faec13476caea0
-
SHA1
234cbf5fb007db06026223c9bf0dc2a57c633570
-
SHA256
f47b1ed305aa05b5b84e7b994e8e6e5e8013831fec6b8922e8309d5ce28f12bc
-
SHA512
258005109e2b4e8974411c292dc06293783c904649bd61792c814e532cfd578e00a8576cda26158d20718d484774a3362ce0fe6140ddeb30169c28ea506f04ad
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\airplane.wtf.exe"C:\Users\Admin\AppData\Local\Temp\airplane.wtf.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.7MB
-
Filesize
9.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
1016KB
-
Filesize
8KB