Overview

overview

9

Static

static

#Reference...20.exe

windows7_x64

9

#Reference...20.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a94c36b23529e901426aed205351ff692e6eb0188f9d163e07609d73b88622bd

  • Size

    822KB

  • Sample

    220520-2bgjjaabdn

  • MD5

    9f30dd80af2a327825f7696c1e7d110d

  • SHA1

    bc929769f39cead31a96f0627071767dfb7a063f

  • SHA256

    a94c36b23529e901426aed205351ff692e6eb0188f9d163e07609d73b88622bd

  • SHA512

    f71ae4116ed88dcde2e545469d959e807620a3bbbb7c75d1a7083b4fdbb84f19701b14d813dbfe5ec6480f9f36147e66c4443f09a15b5e55098a95dd5e6486ee

Score
9/10
evasion

Malware Config

Targets

    • Target

      #Reference_Reciept_Dhl_expidayed_shipping_apporved_owner_2020.exe

    • Size

      850KB

    • MD5

      3873065a859c7028cd9db46bf2950e36

    • SHA1

      88c9d384602aa6f47c8d12af7df6b7df9cb2891f

    • SHA256

      acef143204e66bd0ef761c302176d61d547b9bfd78960c7607a9863bdafaae19

    • SHA512

      5c4d8c076765299ca2f871ba4d5d47ec8c108908767b55c13486a2e293e1f048c0f7a51c5cb48c212854919d11e0830143c0c5200153fde2dbbf82aa8b9a7d91

    Score
    9/10
    evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks