Analysis
- max time kernel
55s - max time network
45s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
- submitted
27/07/2022, 04:47
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.30362.exe
- Size 976KB
- Sample220727-fejbmsacfp
- SHA256 64d8e5fd70d710d77cc38992cc5b9f7a23757e0cf5f0fc6399f53cb160154f74
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.30362.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1280-62-0x000000006F090000-0x000000006F63B000-memory.dmp
memory/1888-54-0x0000000000360000-0x0000000000458000-memory.dmp
memory/1888-55-0x0000000075DC1000-0x0000000075DC3000-memory.dmp
memory/1888-56-0x00000000005D0000-0x00000000005E6000-memory.dmp
memory/1888-57-0x0000000000600000-0x000000000060A000-memory.dmp
memory/1888-58-0x00000000052A0000-0x000000000532C000-memory.dmp
memory/1888-61-0x00000000022F0000-0x000000000232E000-memory.dmp