Analysis
-
max time kernel
52s -
max time network
55s -
platform
windows10-1703_x64 -
resource
win10-20220722-en -
resource tags
arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system -
submitted
09-08-2022 05:27
Static task
static1
General
-
Target
b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe
-
Size
1.8MB
-
MD5
2d6de08a2e114be301be2c3ca6029366
-
SHA1
5a7eb1f7670fb02608b6e501c7a520d7a0299252
-
SHA256
b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98
-
SHA512
6b36520b23639e268c542581c376c64b5eccd750918cbbe5d3822715f0702138bf94118259fb6ab554c4f3d1b7c5ad4a0bb0af06ceee7f6e1bc5c9b3f09d9c6a
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Executes dropped EXE 1 IoCs
Processes:
oobeldr.exepid process 2968 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe -
Processes:
b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exeoobeldr.exepid process 2764 b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe 2764 b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe 2968 oobeldr.exe 2968 oobeldr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1508 schtasks.exe 2864 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exeoobeldr.exepid process 2764 b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe 2764 b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe 2764 b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe 2764 b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe 2968 oobeldr.exe 2968 oobeldr.exe 2968 oobeldr.exe 2968 oobeldr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exeoobeldr.exedescription pid process target process PID 2764 wrote to memory of 1508 2764 b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe schtasks.exe PID 2764 wrote to memory of 1508 2764 b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe schtasks.exe PID 2764 wrote to memory of 1508 2764 b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe schtasks.exe PID 2968 wrote to memory of 2864 2968 oobeldr.exe schtasks.exe PID 2968 wrote to memory of 2864 2968 oobeldr.exe schtasks.exe PID 2968 wrote to memory of 2864 2968 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe"C:\Users\Admin\AppData\Local\Temp\b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD52d6de08a2e114be301be2c3ca6029366
SHA15a7eb1f7670fb02608b6e501c7a520d7a0299252
SHA256b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98
SHA5126b36520b23639e268c542581c376c64b5eccd750918cbbe5d3822715f0702138bf94118259fb6ab554c4f3d1b7c5ad4a0bb0af06ceee7f6e1bc5c9b3f09d9c6a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD52d6de08a2e114be301be2c3ca6029366
SHA15a7eb1f7670fb02608b6e501c7a520d7a0299252
SHA256b0c8932726e7ae5e6f85b078f19980c4e2e5834e9446ff74e73a5b435b0def98
SHA5126b36520b23639e268c542581c376c64b5eccd750918cbbe5d3822715f0702138bf94118259fb6ab554c4f3d1b7c5ad4a0bb0af06ceee7f6e1bc5c9b3f09d9c6a
-
memory/1508-188-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-196-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-195-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-194-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-193-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-192-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-191-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-190-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-178-0x0000000000000000-mapping.dmp
-
memory/1508-189-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-186-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-187-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-185-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-184-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-183-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-182-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-181-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-180-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/1508-179-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-147-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-177-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-150-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-151-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-152-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-154-0x0000000000E80000-0x0000000000EC4000-memory.dmpFilesize
272KB
-
memory/2764-153-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-155-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-156-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-157-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-158-0x00000000011E0000-0x00000000014FF000-memory.dmpFilesize
3.1MB
-
memory/2764-159-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-160-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-161-0x00000000011E0000-0x00000000014FF000-memory.dmpFilesize
3.1MB
-
memory/2764-163-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-162-0x00000000011E0000-0x00000000014FF000-memory.dmpFilesize
3.1MB
-
memory/2764-164-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-165-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-166-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-167-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-168-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-169-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-170-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-171-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-172-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-173-0x00000000011E0000-0x00000000014FF000-memory.dmpFilesize
3.1MB
-
memory/2764-174-0x00000000011E1000-0x00000000011E3000-memory.dmpFilesize
8KB
-
memory/2764-175-0x00000000011E1000-0x00000000011E3000-memory.dmpFilesize
8KB
-
memory/2764-176-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-149-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-148-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-127-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-146-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-145-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-143-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-144-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-142-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-141-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-140-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-139-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-138-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-137-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-136-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-135-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-134-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-133-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-132-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-130-0x00000000011E0000-0x00000000014FF000-memory.dmpFilesize
3.1MB
-
memory/2764-131-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-197-0x00000000011E0000-0x00000000014FF000-memory.dmpFilesize
3.1MB
-
memory/2764-198-0x0000000000E80000-0x0000000000EC4000-memory.dmpFilesize
272KB
-
memory/2764-129-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2764-128-0x0000000077630000-0x00000000777BE000-memory.dmpFilesize
1.6MB
-
memory/2864-247-0x0000000000000000-mapping.dmp
-
memory/2968-211-0x0000000000260000-0x000000000057F000-memory.dmpFilesize
3.1MB
-
memory/2968-243-0x0000000000D90000-0x0000000000DD4000-memory.dmpFilesize
272KB
-
memory/2968-244-0x0000000000260000-0x000000000057F000-memory.dmpFilesize
3.1MB
-
memory/2968-266-0x0000000000260000-0x000000000057F000-memory.dmpFilesize
3.1MB
-
memory/2968-267-0x0000000000D90000-0x0000000000DD4000-memory.dmpFilesize
272KB
-
memory/2968-268-0x0000000000260000-0x000000000057F000-memory.dmpFilesize
3.1MB