Analysis
-
max time kernel
118s -
max time network
148s -
platform
windows10_x64 -
resource
win10-de-20211208 -
submitted
17-02-2022 08:52
General
-
Target
6bf5cf564b05de2da0d9c72b580bd28d2a9155294b786d24298cf39c61b7af0f.exe
-
Size
3.5MB
-
MD5
41b2cdd012ea904a08f614916dbd195c
-
SHA1
e21f8b66d66cd0f207b72bef5b84395f1c6c0df7
-
SHA256
6bf5cf564b05de2da0d9c72b580bd28d2a9155294b786d24298cf39c61b7af0f
-
SHA512
f90b232143abb25b99ed669a212fa6f0cb8c32d86b7b27f1e515ca08f69f5f88824d35316937baaec1c0705e9f9348f81c499c870037911dc6de92a3d75a6220
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file 1 IoCs
-
Themida packer 8 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 38 IoCs
-
Suspicious use of SendNotifyMessage 38 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bf5cf564b05de2da0d9c72b580bd28d2a9155294b786d24298cf39c61b7af0f.exe"C:\Users\Admin\AppData\Local\Temp\6bf5cf564b05de2da0d9c72b580bd28d2a9155294b786d24298cf39c61b7af0f.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
41b2cdd012ea904a08f614916dbd195c
SHA1e21f8b66d66cd0f207b72bef5b84395f1c6c0df7
SHA2566bf5cf564b05de2da0d9c72b580bd28d2a9155294b786d24298cf39c61b7af0f
SHA512f90b232143abb25b99ed669a212fa6f0cb8c32d86b7b27f1e515ca08f69f5f88824d35316937baaec1c0705e9f9348f81c499c870037911dc6de92a3d75a6220
-
MD5
41b2cdd012ea904a08f614916dbd195c
SHA1e21f8b66d66cd0f207b72bef5b84395f1c6c0df7
SHA2566bf5cf564b05de2da0d9c72b580bd28d2a9155294b786d24298cf39c61b7af0f
SHA512f90b232143abb25b99ed669a212fa6f0cb8c32d86b7b27f1e515ca08f69f5f88824d35316937baaec1c0705e9f9348f81c499c870037911dc6de92a3d75a6220
-
MD5
1c897635729d57d0a17747087c377207
SHA156aa0c6dac07367db5eb13b4939d2a5d61d98aed
SHA256c83c8415954ae5745e4e1a7c62e72c4c680a0f009da249cf07d3b38673d407f4
SHA512100ef3ec6fdb8c1ddb61af3183f84850636a823cf1bdb3bd8efe3a72f6b8473f663bbc3cf4d7c72a9a61f0a71a9d753ec94997dea7338ee4a39ae092e29de5e6
-
Filesize
9.5MB
-
Filesize
9.5MB
-
Filesize
8KB
-
Filesize
9.5MB
-
Filesize
9.5MB
-
Filesize
9.5MB
-
Filesize
9.5MB