Analysis
-
max time kernel
162s -
max time network
182s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
24-07-2022 22:15
Behavioral task
behavioral1
Sample
edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe
Resource
win10-20220718-en
General
-
Target
edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe
-
Size
1.9MB
-
MD5
f1652e3ed08e855c196507b001b22c76
-
SHA1
83c5b113042a8f077ec7f84baa0a94511a72072d
-
SHA256
edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a
-
SHA512
923ffa8310be31762fe942ddb092b58203b2da1673050f71c2b6058ad63850b7fbbf187bea8d461fe103c599a6c29360c90b9a7619d09fab03679c7efd6bd903
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe -
Processes:
resource yara_rule behavioral2/memory/2088-117-0x00007FF7591C0000-0x00007FF759771000-memory.dmp themida behavioral2/memory/2088-118-0x00007FF7591C0000-0x00007FF759771000-memory.dmp themida behavioral2/memory/2088-119-0x00007FF7591C0000-0x00007FF759771000-memory.dmp themida behavioral2/memory/2088-120-0x00007FF7591C0000-0x00007FF759771000-memory.dmp themida behavioral2/memory/2088-121-0x00007FF7591C0000-0x00007FF759771000-memory.dmp themida behavioral2/memory/2088-123-0x00007FF7591C0000-0x00007FF759771000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1278860188-1450369398-39028496-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32Com = "C:\\Users\\Public\\Docs\\edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe" edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe -
Processes:
edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exepid process 2088 edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exepid process 2088 edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe"C:\Users\Admin\AppData\Local\Temp\edfc85ba889f72aa942fb12cd05664f15898db5c93d6f44f177e09a3990cd06a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
PID:2088
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2088-117-0x00007FF7591C0000-0x00007FF759771000-memory.dmpFilesize
5.7MB
-
memory/2088-118-0x00007FF7591C0000-0x00007FF759771000-memory.dmpFilesize
5.7MB
-
memory/2088-119-0x00007FF7591C0000-0x00007FF759771000-memory.dmpFilesize
5.7MB
-
memory/2088-120-0x00007FF7591C0000-0x00007FF759771000-memory.dmpFilesize
5.7MB
-
memory/2088-121-0x00007FF7591C0000-0x00007FF759771000-memory.dmpFilesize
5.7MB
-
memory/2088-122-0x00007FFA9D6C0000-0x00007FFA9D89B000-memory.dmpFilesize
1.9MB
-
memory/2088-123-0x00007FF7591C0000-0x00007FF759771000-memory.dmpFilesize
5.7MB