Analysis
-
max time kernel
50s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
25-07-2022 17:01
General
-
Target
20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe
-
Size
6.5MB
-
MD5
68aebec982d6d6df5af8a0e66e0b1213
-
SHA1
44e42b332e9b65a431ca63941d372698c1f5b7d8
-
SHA256
20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3
-
SHA512
5eda091a925b6f151cd2fb7619cd315782d2c16798f3b870a8d870e8aba72abd71a199feab8a700851198168a1b845012173ca47763fe80324233a544c792b1d
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe -
Processes:
resource yara_rule behavioral1/memory/512-118-0x0000000000400000-0x00000000015C9000-memory.dmp themida behavioral1/memory/512-166-0x0000000000400000-0x00000000015C9000-memory.dmp themida behavioral1/memory/512-167-0x0000000000400000-0x00000000015C9000-memory.dmp themida behavioral1/memory/512-168-0x0000000000400000-0x00000000015C9000-memory.dmp themida behavioral1/memory/512-295-0x0000000000400000-0x00000000015C9000-memory.dmp themida behavioral1/memory/512-626-0x0000000000400000-0x00000000015C9000-memory.dmp themida -
Processes:
20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exepid process 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exepid process 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exedescription pid process Token: SeDebugPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 1 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeCreateTokenPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeAssignPrimaryTokenPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeLockMemoryPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeIncreaseQuotaPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeMachineAccountPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeTcbPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeSecurityPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeTakeOwnershipPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeLoadDriverPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeSystemProfilePrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeSystemtimePrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeProfSingleProcessPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeIncBasePriorityPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeCreatePagefilePrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeCreatePermanentPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeBackupPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeRestorePrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeShutdownPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeDebugPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeAuditPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeSystemEnvironmentPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeChangeNotifyPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeRemoteShutdownPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeUndockPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeSyncAgentPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeEnableDelegationPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeManageVolumePrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeImpersonatePrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: SeCreateGlobalPrivilege 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 31 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 32 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 33 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 34 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 35 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 36 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 37 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 38 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 39 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 40 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 41 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 42 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 43 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 44 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 45 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 46 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 47 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe Token: 48 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exepid process 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe 512 20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe"C:\Users\Admin\AppData\Local\Temp\20ad6ebb675a70f37ad9e019108a818463b67174119641f160b2c7f39f35f8e3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/512-118-0x0000000000400000-0x00000000015C9000-memory.dmpFilesize
17.8MB
-
memory/512-117-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-119-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-120-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-121-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-122-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-123-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-124-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-125-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-126-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-127-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-128-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-129-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-130-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-131-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-132-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-133-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-134-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-135-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-136-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-137-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-138-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-139-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-140-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-141-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-142-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-143-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-144-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-145-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-146-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-147-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-148-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-149-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-151-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-150-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-153-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-152-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-155-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-154-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-157-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-158-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-159-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-160-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-161-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-162-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-163-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-156-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-164-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-165-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-166-0x0000000000400000-0x00000000015C9000-memory.dmpFilesize
17.8MB
-
memory/512-167-0x0000000000400000-0x00000000015C9000-memory.dmpFilesize
17.8MB
-
memory/512-168-0x0000000000400000-0x00000000015C9000-memory.dmpFilesize
17.8MB
-
memory/512-169-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-170-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-171-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-172-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-173-0x0000000077C40000-0x0000000077DCE000-memory.dmpFilesize
1.6MB
-
memory/512-174-0x0000000000401000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/512-175-0x0000000000401000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/512-176-0x0000000000401000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/512-177-0x0000000000401000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/512-178-0x0000000000401000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/512-179-0x0000000000401000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/512-180-0x0000000000401000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/512-181-0x0000000000401000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/512-295-0x0000000000400000-0x00000000015C9000-memory.dmpFilesize
17.8MB
-
memory/512-621-0x0000000007E50000-0x0000000007E8C000-memory.dmpFilesize
240KB
-
memory/512-622-0x0000000008280000-0x00000000083CD000-memory.dmpFilesize
1.3MB
-
memory/512-624-0x0000000003BB0000-0x0000000003BCC000-memory.dmpFilesize
112KB
-
memory/512-623-0x0000000007E90000-0x0000000007EDC000-memory.dmpFilesize
304KB
-
memory/512-626-0x0000000000400000-0x00000000015C9000-memory.dmpFilesize
17.8MB