Analysis
-
max time kernel
38s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 04:09
Static task
static1
Behavioral task
behavioral1
Sample
506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32.exe
Resource
win10v2004-20220414-en
General
-
Target
506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32.exe
-
Size
2.2MB
-
MD5
052c154a9921c3b73b0096dc384a1d06
-
SHA1
cd342645b29d36cb6010c27f99a02727154e065c
-
SHA256
506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32
-
SHA512
a0e03522381b4a0c230bf2e5f535df9d5177d983dce16eaeb1e1b7401f7b9597e48965b92067e5cd3b2ac6fa9ab3d22ddefd2ccdc9528849885912bc9ef670e8
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Wine 506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32.exe"C:\Users\Admin\AppData\Local\Temp\506c00ed7ae0a9186274ae0a9e9e2cacd7028a956863074592b8f8f7c0ea5e32.exe"1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1380-54-0x0000000000CC0000-0x000000000154E000-memory.dmpFilesize
8.6MB