Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
09-08-2022 05:21
Static task
static1
General
-
Target
b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe
-
Size
1.8MB
-
MD5
1cf5749fad04f0f16260ac8e53baa075
-
SHA1
4d122685bcacc79f782a5fbac225a454f5ea63f9
-
SHA256
b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a
-
SHA512
0abc2c5ee8f9cb07d962343d7f43453838465add2dc3dced0a61ae86168322fde80d9170b2d4c94b263d7733382e42de13b6cfadfd6137ed8c5d3f762617330b
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Executes dropped EXE 1 IoCs
Processes:
oobeldr.exepid process 4800 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe -
Processes:
b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exeoobeldr.exepid process 412 b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe 412 b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe 4800 oobeldr.exe 4800 oobeldr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2680 schtasks.exe 4976 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exeoobeldr.exepid process 412 b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe 412 b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe 412 b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe 412 b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe 4800 oobeldr.exe 4800 oobeldr.exe 4800 oobeldr.exe 4800 oobeldr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exeoobeldr.exedescription pid process target process PID 412 wrote to memory of 2680 412 b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe schtasks.exe PID 412 wrote to memory of 2680 412 b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe schtasks.exe PID 412 wrote to memory of 2680 412 b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe schtasks.exe PID 4800 wrote to memory of 4976 4800 oobeldr.exe schtasks.exe PID 4800 wrote to memory of 4976 4800 oobeldr.exe schtasks.exe PID 4800 wrote to memory of 4976 4800 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe"C:\Users\Admin\AppData\Local\Temp\b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD51cf5749fad04f0f16260ac8e53baa075
SHA14d122685bcacc79f782a5fbac225a454f5ea63f9
SHA256b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a
SHA5120abc2c5ee8f9cb07d962343d7f43453838465add2dc3dced0a61ae86168322fde80d9170b2d4c94b263d7733382e42de13b6cfadfd6137ed8c5d3f762617330b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD51cf5749fad04f0f16260ac8e53baa075
SHA14d122685bcacc79f782a5fbac225a454f5ea63f9
SHA256b321417ec7f94af2711101f2a8966b1667ecac9e3c68133119d8371fb42dba7a
SHA5120abc2c5ee8f9cb07d962343d7f43453838465add2dc3dced0a61ae86168322fde80d9170b2d4c94b263d7733382e42de13b6cfadfd6137ed8c5d3f762617330b
-
memory/412-118-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-119-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-120-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-121-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-122-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-123-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-124-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-125-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-126-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-127-0x0000000000FE0000-0x00000000012FF000-memory.dmpFilesize
3.1MB
-
memory/412-129-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-128-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-130-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-131-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-132-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-133-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-134-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-135-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-136-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-137-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-138-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-139-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-140-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-141-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-142-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-143-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-144-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-145-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-146-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-147-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-148-0x0000000001300000-0x000000000144A000-memory.dmpFilesize
1.3MB
-
memory/412-149-0x0000000000FE0000-0x00000000012FF000-memory.dmpFilesize
3.1MB
-
memory/412-150-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-151-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-152-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-153-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-154-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-155-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-157-0x0000000000FE0000-0x00000000012FF000-memory.dmpFilesize
3.1MB
-
memory/412-156-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-158-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-159-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-160-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-161-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-162-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-163-0x0000000000FE0000-0x00000000012FF000-memory.dmpFilesize
3.1MB
-
memory/412-166-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-165-0x0000000000FE1000-0x0000000000FE3000-memory.dmpFilesize
8KB
-
memory/412-164-0x0000000000FE1000-0x0000000000FE3000-memory.dmpFilesize
8KB
-
memory/412-167-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-187-0x0000000000FE0000-0x00000000012FF000-memory.dmpFilesize
3.1MB
-
memory/2680-168-0x0000000000000000-mapping.dmp
-
memory/2680-169-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-170-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-172-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-171-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-173-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-175-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-174-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-176-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-177-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-178-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-179-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-180-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-181-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-182-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-183-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-184-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-185-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/2680-186-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/4800-230-0x0000000000120000-0x000000000043F000-memory.dmpFilesize
3.1MB
-
memory/4800-231-0x0000000001430000-0x000000000157A000-memory.dmpFilesize
1.3MB
-
memory/4800-232-0x0000000000120000-0x000000000043F000-memory.dmpFilesize
3.1MB
-
memory/4800-255-0x0000000000120000-0x000000000043F000-memory.dmpFilesize
3.1MB
-
memory/4800-256-0x0000000001430000-0x000000000157A000-memory.dmpFilesize
1.3MB
-
memory/4976-236-0x0000000000000000-mapping.dmp