Analysis

  • max time kernel
    4294181s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    26-03-2022 23:07

General

  • Target

    aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe

  • Size

    1.0MB

  • MD5

    02cadb9489d5db4e68b01febcf6bc2da

  • SHA1

    dbd38f77e72b4db0f7cb9d068773bbffc3a0d37e

  • SHA256

    aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126

  • SHA512

    9a7374c05ed28106096655f0beb6100372a5dd6760df6119d95dfb06180b0d78ad57a66753e52059bbd66ca2357f912e54ced01593ab97ca75ce7bdc395b37d9

Score
9/10

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs
  • Looks for VMWare Tools registry key 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe
    "C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe"
    1⤵
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OxshqXOJkj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp36BA.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1264
    • C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe
      "C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe"
      2⤵
        PID:1396
      • C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe
        "C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe"
        2⤵
          PID:1976
        • C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe
          "C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe"
          2⤵
            PID:380
          • C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe
            "C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe"
            2⤵
              PID:452
            • C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe
              "C:\Users\Admin\AppData\Local\Temp\aa44aadf6a1a59411f8952ba202f87cb87a74cb2ba96a18b16a24a70cdadc126.exe"
              2⤵
                PID:292

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp36BA.tmp

              Filesize

              1KB

              MD5

              6ed15d43bdd548f8b72c0ab0097f29df

              SHA1

              27fcbe874896e3b0d99fd8ed5697b7c522f816fa

              SHA256

              453f1ac926a9c162fede949a3b15b005e3af0dfbb9dcdcdd6c625f5469de4ea3

              SHA512

              7c930b6f9655dd1a41726a5d6674bd747bdc9824ab68427e401acd2fd45900be6e4803ad22545e5919bdc612727261baaa8a5634e1eec44464f1e95969ef331b

            • memory/1908-54-0x0000000000320000-0x0000000000428000-memory.dmp

              Filesize

              1.0MB

            • memory/1908-55-0x00000000005A0000-0x00000000005BA000-memory.dmp

              Filesize

              104KB

            • memory/1908-56-0x00000000057C0000-0x0000000005886000-memory.dmp

              Filesize

              792KB

            • memory/1908-57-0x0000000005880000-0x000000000590E000-memory.dmp

              Filesize

              568KB