Analysis
-
max time kernel
71s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
21-07-2022 10:48
Behavioral task
behavioral1
Sample
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe
Resource
win7-20220718-en
General
-
Target
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe
-
Size
39.3MB
-
MD5
a9eb0ced20bd86d51bb02f2ba9d4a3fd
-
SHA1
1036c06b86135ad9eca7502b8259e29822ba6555
-
SHA256
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7
-
SHA512
8641ed1cd50f750d3e40a959536e015ea44b902d4d9bc3370ee3f554ee6b42ffbebe50c54a3c313ae88125d0eac63c98b0c94311cdfd72874df636ee19c260b8
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe -
Loads dropped DLL 1 IoCs
Processes:
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exepid process 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1584-55-0x0000000000400000-0x000000000136B000-memory.dmp themida behavioral1/memory/1584-56-0x0000000000400000-0x000000000136B000-memory.dmp themida behavioral1/memory/1584-57-0x0000000000400000-0x000000000136B000-memory.dmp themida behavioral1/memory/1584-58-0x0000000000400000-0x000000000136B000-memory.dmp themida behavioral1/memory/1584-60-0x0000000000400000-0x000000000136B000-memory.dmp themida -
Processes:
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exepid process 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exepid process 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exedescription pid process Token: SeDebugPrivilege 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe Token: SeDebugPrivilege 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe Token: SeDebugPrivilege 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe Token: SeDebugPrivilege 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exepid process 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exepid process 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exepid process 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe 1584 19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe"C:\Users\Admin\AppData\Local\Temp\19271a21eecc6fd0a2c0057ea715e9b8f81c53d2052239e3ee25a8893b5d95e7.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\Core.bplFilesize
221KB
MD58651c784128a79090369ca5beeaad39f
SHA1ff861ccc0ee25978f01b4fc4b85644f367dcb3f8
SHA2562cc2cf20ab39b49c3570826ece739975fcbd22f6c51a33b0b47a073d4bc39a7c
SHA5127c6627bcc0cd9a3aa2441917c820517b64e8bfee97934d3c995c5f21e7457ba82825aabc8f849712db92be06b05bedfb2265be898f9b33be2302e3a155a3c83f
-
memory/1584-60-0x0000000000400000-0x000000000136B000-memory.dmpFilesize
15.4MB
-
memory/1584-56-0x0000000000400000-0x000000000136B000-memory.dmpFilesize
15.4MB
-
memory/1584-57-0x0000000000400000-0x000000000136B000-memory.dmpFilesize
15.4MB
-
memory/1584-58-0x0000000000400000-0x000000000136B000-memory.dmpFilesize
15.4MB
-
memory/1584-59-0x0000000077400000-0x0000000077580000-memory.dmpFilesize
1.5MB
-
memory/1584-54-0x00000000756B1000-0x00000000756B3000-memory.dmpFilesize
8KB
-
memory/1584-61-0x0000000077400000-0x0000000077580000-memory.dmpFilesize
1.5MB
-
memory/1584-62-0x00000000031B1000-0x00000000031CB000-memory.dmpFilesize
104KB
-
memory/1584-63-0x00000000031B1000-0x00000000031CB000-memory.dmpFilesize
104KB
-
memory/1584-64-0x00000000031B1000-0x00000000031CB000-memory.dmpFilesize
104KB
-
memory/1584-65-0x00000000031B1000-0x00000000031CB000-memory.dmpFilesize
104KB
-
memory/1584-66-0x0000000010000000-0x0000000010012000-memory.dmpFilesize
72KB
-
memory/1584-55-0x0000000000400000-0x000000000136B000-memory.dmpFilesize
15.4MB