Analysis
-
max time kernel
51s -
max time network
128s -
platform
windows10-1703_x64 -
resource
win10-20220722-en -
resource tags
arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system -
submitted
09-08-2022 05:22
Static task
static1
General
-
Target
f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe
-
Size
1.8MB
-
MD5
52fde15554cdda967fca765be4c3d0d4
-
SHA1
f8a0ca4786e34dea88d47295c60e5f9421ae1a04
-
SHA256
f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d
-
SHA512
db948a6647e53a9bbd793d8cf80d05873b0e3f4f3355ad7240171cc4e40bae18d2aeca83061b880774cb5d2b9c086fd1e031f3c2c09b3067daad539006b77161
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Executes dropped EXE 1 IoCs
Processes:
oobeldr.exepid process 3056 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
oobeldr.exef96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe -
Processes:
oobeldr.exef96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exeoobeldr.exepid process 4748 f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe 4748 f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe 3056 oobeldr.exe 3056 oobeldr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exeoobeldr.exepid process 4748 f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe 4748 f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe 4748 f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe 4748 f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe 3056 oobeldr.exe 3056 oobeldr.exe 3056 oobeldr.exe 3056 oobeldr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exeoobeldr.exedescription pid process target process PID 4748 wrote to memory of 948 4748 f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe schtasks.exe PID 4748 wrote to memory of 948 4748 f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe schtasks.exe PID 4748 wrote to memory of 948 4748 f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe schtasks.exe PID 3056 wrote to memory of 4876 3056 oobeldr.exe schtasks.exe PID 3056 wrote to memory of 4876 3056 oobeldr.exe schtasks.exe PID 3056 wrote to memory of 4876 3056 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe"C:\Users\Admin\AppData\Local\Temp\f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD552fde15554cdda967fca765be4c3d0d4
SHA1f8a0ca4786e34dea88d47295c60e5f9421ae1a04
SHA256f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d
SHA512db948a6647e53a9bbd793d8cf80d05873b0e3f4f3355ad7240171cc4e40bae18d2aeca83061b880774cb5d2b9c086fd1e031f3c2c09b3067daad539006b77161
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD552fde15554cdda967fca765be4c3d0d4
SHA1f8a0ca4786e34dea88d47295c60e5f9421ae1a04
SHA256f96d8621bf8830f2ce8d216e5abee90419e5a5760f3cfaa220ba46a0bda5d87d
SHA512db948a6647e53a9bbd793d8cf80d05873b0e3f4f3355ad7240171cc4e40bae18d2aeca83061b880774cb5d2b9c086fd1e031f3c2c09b3067daad539006b77161
-
memory/948-191-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-181-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-177-0x0000000000000000-mapping.dmp
-
memory/948-179-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-190-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-180-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-195-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-194-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-193-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-192-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-178-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-182-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-187-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-188-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-189-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-186-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-185-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-184-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/948-183-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/3056-243-0x00000000002A0000-0x00000000005BF000-memory.dmpFilesize
3.1MB
-
memory/3056-266-0x0000000000C10000-0x0000000000C54000-memory.dmpFilesize
272KB
-
memory/3056-265-0x00000000002A0000-0x00000000005BF000-memory.dmpFilesize
3.1MB
-
memory/3056-240-0x00000000002A0000-0x00000000005BF000-memory.dmpFilesize
3.1MB
-
memory/3056-242-0x0000000000C10000-0x0000000000C54000-memory.dmpFilesize
272KB
-
memory/4748-145-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-150-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-155-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-156-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-157-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-158-0x00000000003E0000-0x00000000006FF000-memory.dmpFilesize
3.1MB
-
memory/4748-160-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-159-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-161-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-162-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-163-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-164-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-165-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-166-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-167-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-169-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-168-0x00000000003E0000-0x00000000006FF000-memory.dmpFilesize
3.1MB
-
memory/4748-170-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-171-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-172-0x00000000003E1000-0x00000000003E3000-memory.dmpFilesize
8KB
-
memory/4748-173-0x00000000003E1000-0x00000000003E3000-memory.dmpFilesize
8KB
-
memory/4748-174-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-175-0x00000000003E0000-0x00000000006FF000-memory.dmpFilesize
3.1MB
-
memory/4748-176-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-153-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-152-0x0000000002BA0000-0x0000000002BE4000-memory.dmpFilesize
272KB
-
memory/4748-151-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-154-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-149-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-148-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-147-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-127-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-146-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-144-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-143-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-142-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-141-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-140-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-139-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-138-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-136-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-137-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-135-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-196-0x00000000003E0000-0x00000000006FF000-memory.dmpFilesize
3.1MB
-
memory/4748-197-0x0000000002BA0000-0x0000000002BE4000-memory.dmpFilesize
272KB
-
memory/4748-134-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-133-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-131-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-132-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-130-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4748-128-0x00000000003E0000-0x00000000006FF000-memory.dmpFilesize
3.1MB
-
memory/4748-129-0x0000000077670000-0x00000000777FE000-memory.dmpFilesize
1.6MB
-
memory/4876-246-0x0000000000000000-mapping.dmp