Analysis
-
max time kernel
122s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 12:33
Static task
static1
Behavioral task
behavioral1
Sample
mavens[1].exe
Resource
win7-en-20211208
General
-
Target
mavens[1].exe
-
Size
3.5MB
-
MD5
3c7b73307754a88b0cab311b436b60a6
-
SHA1
44e620b74b4c8df6d66fc2def07f3cea73eb8421
-
SHA256
83895bba41d8a8e50a72830c47b24a59fa59b9a9a519417208e688b174e468d1
-
SHA512
13c57ecc348354c19dc6833da13c44a5b72b7f7db801ac2d6ea3ddd8410bc50a3daefd763840c22305dfd599f5d458f5addc93fc6530a7e481b531dec5b78781
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
IntelRapid.exepid process 656 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mavens[1].exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mavens[1].exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion mavens[1].exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe -
Drops startup file 1 IoCs
Processes:
mavens[1].exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk mavens[1].exe -
Loads dropped DLL 3 IoCs
Processes:
mavens[1].exepid process 1956 mavens[1].exe 1956 mavens[1].exe 1956 mavens[1].exe -
Processes:
resource yara_rule behavioral1/memory/1956-55-0x000000013F0C0000-0x000000013FA3A000-memory.dmp themida behavioral1/memory/1956-56-0x000000013F0C0000-0x000000013FA3A000-memory.dmp themida behavioral1/memory/1956-57-0x000000013F0C0000-0x000000013FA3A000-memory.dmp themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral1/memory/656-64-0x000000013F0D0000-0x000000013FA4A000-memory.dmp themida behavioral1/memory/656-65-0x000000013F0D0000-0x000000013FA4A000-memory.dmp themida behavioral1/memory/656-66-0x000000013F0D0000-0x000000013FA4A000-memory.dmp themida -
Processes:
mavens[1].exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mavens[1].exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
mavens[1].exeIntelRapid.exepid process 1956 mavens[1].exe 656 IntelRapid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 656 IntelRapid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
mavens[1].exedescription pid process target process PID 1956 wrote to memory of 656 1956 mavens[1].exe IntelRapid.exe PID 1956 wrote to memory of 656 1956 mavens[1].exe IntelRapid.exe PID 1956 wrote to memory of 656 1956 mavens[1].exe IntelRapid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mavens[1].exe"C:\Users\Admin\AppData\Local\Temp\mavens[1].exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
3c7b73307754a88b0cab311b436b60a6
SHA144e620b74b4c8df6d66fc2def07f3cea73eb8421
SHA25683895bba41d8a8e50a72830c47b24a59fa59b9a9a519417208e688b174e468d1
SHA51213c57ecc348354c19dc6833da13c44a5b72b7f7db801ac2d6ea3ddd8410bc50a3daefd763840c22305dfd599f5d458f5addc93fc6530a7e481b531dec5b78781
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
3c7b73307754a88b0cab311b436b60a6
SHA144e620b74b4c8df6d66fc2def07f3cea73eb8421
SHA25683895bba41d8a8e50a72830c47b24a59fa59b9a9a519417208e688b174e468d1
SHA51213c57ecc348354c19dc6833da13c44a5b72b7f7db801ac2d6ea3ddd8410bc50a3daefd763840c22305dfd599f5d458f5addc93fc6530a7e481b531dec5b78781
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
3c7b73307754a88b0cab311b436b60a6
SHA144e620b74b4c8df6d66fc2def07f3cea73eb8421
SHA25683895bba41d8a8e50a72830c47b24a59fa59b9a9a519417208e688b174e468d1
SHA51213c57ecc348354c19dc6833da13c44a5b72b7f7db801ac2d6ea3ddd8410bc50a3daefd763840c22305dfd599f5d458f5addc93fc6530a7e481b531dec5b78781
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
3c7b73307754a88b0cab311b436b60a6
SHA144e620b74b4c8df6d66fc2def07f3cea73eb8421
SHA25683895bba41d8a8e50a72830c47b24a59fa59b9a9a519417208e688b174e468d1
SHA51213c57ecc348354c19dc6833da13c44a5b72b7f7db801ac2d6ea3ddd8410bc50a3daefd763840c22305dfd599f5d458f5addc93fc6530a7e481b531dec5b78781
-
memory/656-64-0x000000013F0D0000-0x000000013FA4A000-memory.dmpFilesize
9.5MB
-
memory/656-65-0x000000013F0D0000-0x000000013FA4A000-memory.dmpFilesize
9.5MB
-
memory/656-66-0x000000013F0D0000-0x000000013FA4A000-memory.dmpFilesize
9.5MB
-
memory/1956-55-0x000000013F0C0000-0x000000013FA3A000-memory.dmpFilesize
9.5MB
-
memory/1956-56-0x000000013F0C0000-0x000000013FA3A000-memory.dmpFilesize
9.5MB
-
memory/1956-57-0x000000013F0C0000-0x000000013FA3A000-memory.dmpFilesize
9.5MB
-
memory/1956-58-0x0000000077920000-0x0000000077922000-memory.dmpFilesize
8KB
-
memory/1956-59-0x000007FEFC151000-0x000007FEFC153000-memory.dmpFilesize
8KB