Overview

overview

9

Static

static

8

f895e4d8ab...1c.exe

windows7_x64

9

f895e4d8ab...1c.exe

windows10-2004_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f895e4d8abe7ebe924498dc1c5af9ab9af5533bb713404f752d9a4536968441c

  • Size

    110KB

  • Sample

    220520-2s4qdsahhq

  • MD5

    2926548716d0ffc875d9cddf62c03911

  • SHA1

    175d40cb33cc6c01077fd3e765950e36d8773e0a

  • SHA256

    f895e4d8abe7ebe924498dc1c5af9ab9af5533bb713404f752d9a4536968441c

  • SHA512

    1af5252e8430b285269b4a9a31527f9af5c35db50310f306068ded2601f71fae647c39b3190113e82d2c8ef20f94032b82dab481cc4a40c6649b0064d770efcd

Score
9/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      f895e4d8abe7ebe924498dc1c5af9ab9af5533bb713404f752d9a4536968441c

    • Size

      110KB

    • MD5

      2926548716d0ffc875d9cddf62c03911

    • SHA1

      175d40cb33cc6c01077fd3e765950e36d8773e0a

    • SHA256

      f895e4d8abe7ebe924498dc1c5af9ab9af5533bb713404f752d9a4536968441c

    • SHA512

      1af5252e8430b285269b4a9a31527f9af5c35db50310f306068ded2601f71fae647c39b3190113e82d2c8ef20f94032b82dab481cc4a40c6649b0064d770efcd

    Score
    9/10
    evasionpersistence

    • Enumerates VirtualBox registry keys

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

5
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

5
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks