Analysis
-
max time kernel
133s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
02-08-2022 12:51
Behavioral task
behavioral1
Sample
091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exe
Resource
win7-20220715-en
General
-
Target
091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exe
-
Size
5.9MB
-
MD5
d9491ef83fba3d37ca9ba1bb3c26ef1b
-
SHA1
163f97449c71fd4f9f5e7a7ed75b34404560525a
-
SHA256
091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d
-
SHA512
e09f72328abfea0d7378dac8e0eb05ff95400592d744fb47a8d8a7b58f1705dc15e511cb12dcf6973994c0ddbf5a3bd95ccf619560d1125095ae88180c272748
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exe -
Loads dropped DLL 2 IoCs
Processes:
091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exepid process 1108 091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exe 1108 091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exe -
Processes:
resource yara_rule behavioral1/memory/1108-55-0x0000000000400000-0x0000000000A46000-memory.dmp themida behavioral1/memory/1108-56-0x0000000000400000-0x0000000000A46000-memory.dmp themida behavioral1/memory/1108-57-0x0000000000400000-0x0000000000A46000-memory.dmp themida behavioral1/memory/1108-60-0x0000000000400000-0x0000000000A46000-memory.dmp themida behavioral1/memory/1108-61-0x0000000000400000-0x0000000000A46000-memory.dmp themida -
Processes:
091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exe"C:\Users\Admin\AppData\Local\Temp\091e2f9e98f85a667be7612ababd1627ab4dccd979e0d61e2cd617cae5fed19d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nst8EBA.tmp\INetC.dllFilesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
\Users\Admin\AppData\Local\Temp\nst8EBA.tmp\xml.dllFilesize
1.4MB
MD5b4ae4a8e28e7f51cd2f4f7513b9b5a49
SHA105d3901ae95363a4c1d3b505c929b068f41132a8
SHA256bf73bae4f3cee77f6846dc34f0a9e6bbf40b5fcd537b704ef66b85fa83d7e55a
SHA5120efcfe921a5c754eed1420ab2bb7955060eb7ad3acd771eea46d28ee04c1a014b44cde31bdef67be03c01266348b9ecb6194b22ec66cac1bb6ae39dec5ec1fc4
-
memory/1108-54-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/1108-55-0x0000000000400000-0x0000000000A46000-memory.dmpFilesize
6.3MB
-
memory/1108-56-0x0000000000400000-0x0000000000A46000-memory.dmpFilesize
6.3MB
-
memory/1108-57-0x0000000000400000-0x0000000000A46000-memory.dmpFilesize
6.3MB
-
memory/1108-60-0x0000000000400000-0x0000000000A46000-memory.dmpFilesize
6.3MB
-
memory/1108-61-0x0000000000400000-0x0000000000A46000-memory.dmpFilesize
6.3MB