c32fd7c62aab99cc4728af00fc88314eb353e8ed927b25518a8cf8aae6ee294d

General

Target

SHIPING_.exe
Size

324KB
MD5

ba845238a18fce703027ff6ead54d39d
SHA1

b4330999fa833f70c8043d356141619a12888833
SHA256

76fd32c94282886e069385963dae1a78eaaac41d2f124d7311476a344ebd8e49
SHA512

b35fc1dac8c036f530ce427fee622e36a224ebf7be2f861a16ac21fd6a57678410487374c783d47e5602dba03f59b771a1afeff143dfaf39dcc0231c2050af9a

Score

9^/10

evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SHIPING_.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SHIPING_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SHIPING_.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SHIPING_.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	SHIPING_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SHIPING_.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 560 WerFault.exe SHIPING_.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SHIPING_.exe

pid process

560 SHIPING_.exe
560 SHIPING_.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SHIPING_.exe

description pid process

Token: SeDebugPrivilege 560 SHIPING_.exe

pid	pid_target	process	target process
1712	560	WerFault.exe	SHIPING_.exe

pid	process
560	SHIPING_.exe
560	SHIPING_.exe

description	pid	process
Token: SeDebugPrivilege	560	SHIPING_.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SHIPING_.exe

description	pid	process	target process
PID 560 wrote to memory of 1712	560	SHIPING_.exe	WerFault.exe
PID 560 wrote to memory of 1712	560	SHIPING_.exe	WerFault.exe
PID 560 wrote to memory of 1712	560	SHIPING_.exe	WerFault.exe
PID 560 wrote to memory of 1712	560	SHIPING_.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SHIPING_.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPING_.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 50592
2⤵
- Program crash
PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-54-0x0000000000940000-0x0000000000998000-memory.dmp

Filesize
352KB

Download
memory/560-55-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/560-56-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/560-57-0x00000000008E0000-0x0000000000926000-memory.dmp

Filesize
280KB

Download
memory/560-58-0x0000000000290000-0x00000000002B0000-memory.dmp

Filesize
128KB

Download
memory/1712-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads