Analysis
- max time kernel
151s - max time network
117s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
01/07/2022, 07:15
Static task
static1
Behavioral task
behavioral1
Sample
72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe
- Size 579KB
- Sample220701-h3jcnahdfn
- SHA256 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51
- MD5 d4424c0f1916c8257e0d00925aa8e85d
- SHA1 a74f9778e3013871968e5d7ffecb1d25666b5f63
- SHA512 d072d41e5e2910c857bf44b105a796d27643f350694fe1fbda3ba58fb6e32564aa138c873b5f00e6025dcddd4d7bc862e723e26e6a435cbec6d2c99e5dd0a8c6
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Wine 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\KXNXADIKBN.exe\"" 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1472 set thread context of 3796 1472 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 87 PID 3796 set thread context of 1464 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 88 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1472 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 1472 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1472 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 1472 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1472 wrote to memory of 3796 1472 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 87 PID 1472 wrote to memory of 3796 1472 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 87 PID 1472 wrote to memory of 3796 1472 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 87 PID 3796 wrote to memory of 1464 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 88 PID 3796 wrote to memory of 1464 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 88 PID 3796 wrote to memory of 1464 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 88 PID 3796 wrote to memory of 1464 3796 72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe"C:\Users\Admin\AppData\Local\Temp\72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe"C:\Users\Admin\AppData\Local\Temp\72c032726021b1c3790a711a2b533c6ec5cca3c738a2a646eb73ae0080966a51.exe"2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\syswow64\svchost.exe3⤵PID:1464
-
-