Analysis
-
max time kernel
68s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 02:49
Static task
static1
Behavioral task
behavioral1
Sample
PO102.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
PO102.exe
-
Size
368KB
-
MD5
544f97d08c44accf6feb140704686ad9
-
SHA1
198054b26aa1895ae9e6533a449d52dadbbcd0b5
-
SHA256
548f6937985adb04cce6bda4127f3d2af247feada21eda348d1d6a0e8dd7d2c7
-
SHA512
1acc9b9bae1f369d0e717bbd22e2861455b91e942398833004cdf4d8022230a144ea81126a094bb76f509b1281cacffa7e069b2f5c99e6b19621887b904164bc
Score
9/10
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
PO102.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PO102.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PO102.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
PO102.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum PO102.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 PO102.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PO102.exepid process 1912 PO102.exe 1912 PO102.exe 1912 PO102.exe 1912 PO102.exe 1912 PO102.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PO102.exedescription pid process Token: SeDebugPrivilege 1912 PO102.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
PO102.exedescription pid process target process PID 1912 wrote to memory of 596 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 596 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 596 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 596 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 1824 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 1824 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 1824 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 1824 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 380 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 380 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 380 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 380 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 528 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 528 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 528 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 528 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 1736 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 1736 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 1736 1912 PO102.exe PO102.exe PID 1912 wrote to memory of 1736 1912 PO102.exe PO102.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO102.exe"C:\Users\Admin\AppData\Local\Temp\PO102.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO102.exe"C:\Users\Admin\AppData\Local\Temp\PO102.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO102.exe"C:\Users\Admin\AppData\Local\Temp\PO102.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO102.exe"C:\Users\Admin\AppData\Local\Temp\PO102.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO102.exe"C:\Users\Admin\AppData\Local\Temp\PO102.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PO102.exe"C:\Users\Admin\AppData\Local\Temp\PO102.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1912-54-0x00000000003F0000-0x0000000000450000-memory.dmpFilesize
384KB
-
memory/1912-55-0x0000000075F61000-0x0000000075F63000-memory.dmpFilesize
8KB
-
memory/1912-56-0x0000000000320000-0x000000000032A000-memory.dmpFilesize
40KB
-
memory/1912-57-0x0000000000920000-0x000000000096C000-memory.dmpFilesize
304KB
-
memory/1912-58-0x00000000020D0000-0x0000000002104000-memory.dmpFilesize
208KB