Analysis
-
max time kernel
51s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
09-08-2022 05:18
Static task
static1
General
-
Target
fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe
-
Size
1.8MB
-
MD5
522c712c417436213b382e9326f6257a
-
SHA1
0864ed18f8e40dce0d48e9a1b85d4ac8f8ee3295
-
SHA256
fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16
-
SHA512
69d44e30f3244d08e215a0398ec4313fb20c0988320bfe07dc09437c30019b8ccc13e4716d521b80730c2cf1187117c564cb6d0bd2572c6cf6ece30b94d404da
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Executes dropped EXE 1 IoCs
Processes:
oobeldr.exepid process 4048 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
oobeldr.exefb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe -
Processes:
fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exeoobeldr.exepid process 3880 fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe 3880 fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe 4048 oobeldr.exe 4048 oobeldr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exeoobeldr.exepid process 3880 fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe 3880 fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe 3880 fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe 3880 fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe 4048 oobeldr.exe 4048 oobeldr.exe 4048 oobeldr.exe 4048 oobeldr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exeoobeldr.exedescription pid process target process PID 3880 wrote to memory of 584 3880 fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe schtasks.exe PID 3880 wrote to memory of 584 3880 fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe schtasks.exe PID 3880 wrote to memory of 584 3880 fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe schtasks.exe PID 4048 wrote to memory of 1556 4048 oobeldr.exe schtasks.exe PID 4048 wrote to memory of 1556 4048 oobeldr.exe schtasks.exe PID 4048 wrote to memory of 1556 4048 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe"C:\Users\Admin\AppData\Local\Temp\fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD5522c712c417436213b382e9326f6257a
SHA10864ed18f8e40dce0d48e9a1b85d4ac8f8ee3295
SHA256fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16
SHA51269d44e30f3244d08e215a0398ec4313fb20c0988320bfe07dc09437c30019b8ccc13e4716d521b80730c2cf1187117c564cb6d0bd2572c6cf6ece30b94d404da
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD5522c712c417436213b382e9326f6257a
SHA10864ed18f8e40dce0d48e9a1b85d4ac8f8ee3295
SHA256fb460bfdf1f932d7ecfb1b7cbfb8017b1d7a1e229a6b8abe65f76e3056b12c16
SHA51269d44e30f3244d08e215a0398ec4313fb20c0988320bfe07dc09437c30019b8ccc13e4716d521b80730c2cf1187117c564cb6d0bd2572c6cf6ece30b94d404da
-
memory/584-180-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-178-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-185-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-184-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-183-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-182-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-181-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-179-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-166-0x0000000000000000-mapping.dmp
-
memory/584-167-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-177-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-176-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-175-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-174-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-173-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-172-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-170-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-169-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/584-168-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1556-235-0x0000000000000000-mapping.dmp
-
memory/3880-137-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-117-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-140-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-143-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-142-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-144-0x00000000014D0000-0x0000000001514000-memory.dmpFilesize
272KB
-
memory/3880-145-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-146-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-147-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-148-0x0000000000A60000-0x0000000000D7F000-memory.dmpFilesize
3.1MB
-
memory/3880-149-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-150-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-151-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-152-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-153-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-154-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-155-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-156-0x0000000000A60000-0x0000000000D7F000-memory.dmpFilesize
3.1MB
-
memory/3880-157-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-158-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-159-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-160-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-161-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-162-0x0000000000A61000-0x0000000000A63000-memory.dmpFilesize
8KB
-
memory/3880-163-0x0000000000A61000-0x0000000000A63000-memory.dmpFilesize
8KB
-
memory/3880-164-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-165-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-139-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-138-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-141-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-136-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-171-0x0000000000A60000-0x0000000000D7F000-memory.dmpFilesize
3.1MB
-
memory/3880-135-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-134-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-133-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-132-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-129-0x0000000000A60000-0x0000000000D7F000-memory.dmpFilesize
3.1MB
-
memory/3880-131-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-130-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-128-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-127-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-126-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-125-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-124-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-123-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-122-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-121-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-186-0x0000000000A60000-0x0000000000D7F000-memory.dmpFilesize
3.1MB
-
memory/3880-187-0x00000000014D0000-0x0000000001514000-memory.dmpFilesize
272KB
-
memory/3880-120-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-119-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/3880-118-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/4048-224-0x00000000013F0000-0x000000000153A000-memory.dmpFilesize
1.3MB
-
memory/4048-221-0x0000000000CC0000-0x0000000000FDF000-memory.dmpFilesize
3.1MB
-
memory/4048-254-0x0000000000CC0000-0x0000000000FDF000-memory.dmpFilesize
3.1MB
-
memory/4048-255-0x0000000000CC0000-0x0000000000FDF000-memory.dmpFilesize
3.1MB
-
memory/4048-256-0x00000000013F0000-0x000000000153A000-memory.dmpFilesize
1.3MB
-
memory/4048-257-0x0000000000CC0000-0x0000000000FDF000-memory.dmpFilesize
3.1MB