Analysis
-
max time kernel
52s -
max time network
153s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
09-08-2022 05:20
Static task
static1
General
-
Target
32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe
-
Size
1.8MB
-
MD5
5a2e98544760420372656086638a96ff
-
SHA1
d2456c49fb15ccac60a7a3d0a22c30345b3b600e
-
SHA256
32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189
-
SHA512
7098440cbbe69a6a929b11cd197ae05822e39de4633be7264d9b5d3895205453b64871b24c7b9fa20d06495349a8f66952d52a7053b69608b88b9766d5e4cbd3
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Executes dropped EXE 1 IoCs
Processes:
oobeldr.exepid process 3344 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe -
Processes:
32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exeoobeldr.exepid process 808 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe 808 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe 3344 oobeldr.exe 3344 oobeldr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4920 schtasks.exe 4356 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exeoobeldr.exepid process 808 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe 808 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe 808 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe 808 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe 3344 oobeldr.exe 3344 oobeldr.exe 3344 oobeldr.exe 3344 oobeldr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exeoobeldr.exedescription pid process target process PID 808 wrote to memory of 4920 808 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe schtasks.exe PID 808 wrote to memory of 4920 808 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe schtasks.exe PID 808 wrote to memory of 4920 808 32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe schtasks.exe PID 3344 wrote to memory of 4356 3344 oobeldr.exe schtasks.exe PID 3344 wrote to memory of 4356 3344 oobeldr.exe schtasks.exe PID 3344 wrote to memory of 4356 3344 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe"C:\Users\Admin\AppData\Local\Temp\32a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD55a2e98544760420372656086638a96ff
SHA1d2456c49fb15ccac60a7a3d0a22c30345b3b600e
SHA25632a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189
SHA5127098440cbbe69a6a929b11cd197ae05822e39de4633be7264d9b5d3895205453b64871b24c7b9fa20d06495349a8f66952d52a7053b69608b88b9766d5e4cbd3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD55a2e98544760420372656086638a96ff
SHA1d2456c49fb15ccac60a7a3d0a22c30345b3b600e
SHA25632a9dd8f5a9dffca05382771e65444702966fd139c94580d8dbaa948ba003189
SHA5127098440cbbe69a6a929b11cd197ae05822e39de4633be7264d9b5d3895205453b64871b24c7b9fa20d06495349a8f66952d52a7053b69608b88b9766d5e4cbd3
-
memory/808-156-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-118-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-120-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-121-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-122-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-123-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-124-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-125-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-126-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-127-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-128-0x00000000002F0000-0x000000000060F000-memory.dmpFilesize
3.1MB
-
memory/808-130-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-129-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-131-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-132-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-133-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-134-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-135-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-136-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-137-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-138-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-139-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-140-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-141-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-142-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-143-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-144-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-145-0x00000000028B0000-0x00000000028F4000-memory.dmpFilesize
272KB
-
memory/808-146-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-147-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-148-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-149-0x00000000002F0000-0x000000000060F000-memory.dmpFilesize
3.1MB
-
memory/808-150-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-151-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-152-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-154-0x00000000002F0000-0x000000000060F000-memory.dmpFilesize
3.1MB
-
memory/808-153-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-155-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-162-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-157-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-119-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-159-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-160-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-161-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-158-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-163-0x00000000002F0000-0x000000000060F000-memory.dmpFilesize
3.1MB
-
memory/808-164-0x00000000002F1000-0x00000000002F3000-memory.dmpFilesize
8KB
-
memory/808-165-0x00000000002F1000-0x00000000002F3000-memory.dmpFilesize
8KB
-
memory/808-166-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-167-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/808-187-0x00000000002F0000-0x000000000060F000-memory.dmpFilesize
3.1MB
-
memory/808-188-0x00000000028B0000-0x00000000028F4000-memory.dmpFilesize
272KB
-
memory/3344-222-0x0000000000910000-0x0000000000A5A000-memory.dmpFilesize
1.3MB
-
memory/3344-260-0x0000000000290000-0x00000000005AF000-memory.dmpFilesize
3.1MB
-
memory/3344-259-0x0000000000290000-0x00000000005AF000-memory.dmpFilesize
3.1MB
-
memory/3344-258-0x0000000000910000-0x0000000000A5A000-memory.dmpFilesize
1.3MB
-
memory/3344-257-0x0000000000290000-0x00000000005AF000-memory.dmpFilesize
3.1MB
-
memory/3344-256-0x0000000000290000-0x00000000005AF000-memory.dmpFilesize
3.1MB
-
memory/3344-220-0x0000000000290000-0x00000000005AF000-memory.dmpFilesize
3.1MB
-
memory/3344-223-0x0000000000290000-0x00000000005AF000-memory.dmpFilesize
3.1MB
-
memory/4356-237-0x0000000000000000-mapping.dmp
-
memory/4920-174-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-172-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-178-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-180-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-169-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-170-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-177-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-175-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-173-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-176-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-171-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-181-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-168-0x0000000000000000-mapping.dmp
-
memory/4920-179-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-182-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-183-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-184-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-185-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB
-
memory/4920-186-0x0000000077450000-0x00000000775DE000-memory.dmpFilesize
1.6MB