Analysis
-
max time kernel
53s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
02-08-2022 12:50
Behavioral task
behavioral1
Sample
f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exe
Resource
win7-20220715-en
General
-
Target
f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exe
-
Size
5.9MB
-
MD5
9b9dcdc20109ab88b80fc94d15efb636
-
SHA1
fbb772787cae0ad52540d3a0f7847be6432a7a2c
-
SHA256
f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d
-
SHA512
2df42f5a3cbcb3adc33838e72d3c0dd381372a92aa3af2c221a6c3c6b536cadfd12d594523338d78aa5120869b62a5e1607c015c1a7676c0efbb84b929fa9ff0
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exe -
Loads dropped DLL 2 IoCs
Processes:
f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exepid process 1968 f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exe 1968 f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exe -
Processes:
resource yara_rule behavioral1/memory/1968-55-0x0000000000400000-0x0000000000A43000-memory.dmp themida behavioral1/memory/1968-56-0x0000000000400000-0x0000000000A43000-memory.dmp themida behavioral1/memory/1968-57-0x0000000000400000-0x0000000000A43000-memory.dmp themida behavioral1/memory/1968-60-0x0000000000400000-0x0000000000A43000-memory.dmp themida behavioral1/memory/1968-61-0x0000000000400000-0x0000000000A43000-memory.dmp themida -
Processes:
f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exe"C:\Users\Admin\AppData\Local\Temp\f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nst3610.tmp\INetC.dllFilesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
\Users\Admin\AppData\Local\Temp\nst3610.tmp\xml.dllFilesize
1.3MB
MD588708efccdd5ff09edec8c7c5eea8cff
SHA126f2502e186cc063a534e9fd84d1cd5168d3f908
SHA256c74ee241bda68782dd2885bbf8e0a38fcebdc04951b5db727cd0ea90e7858b44
SHA512aecc8ab35f4cfa9eb88b5f5dc65f020515dd3ee502c6d0f133276da8a8aaf43081bf8c7b6468261765dd7b7acc895f55520478e10e31bd9e811d8bffce0997a8
-
memory/1968-54-0x00000000754D1000-0x00000000754D3000-memory.dmpFilesize
8KB
-
memory/1968-55-0x0000000000400000-0x0000000000A43000-memory.dmpFilesize
6.3MB
-
memory/1968-56-0x0000000000400000-0x0000000000A43000-memory.dmpFilesize
6.3MB
-
memory/1968-57-0x0000000000400000-0x0000000000A43000-memory.dmpFilesize
6.3MB
-
memory/1968-60-0x0000000000400000-0x0000000000A43000-memory.dmpFilesize
6.3MB
-
memory/1968-61-0x0000000000400000-0x0000000000A43000-memory.dmpFilesize
6.3MB