General
-
Target
taskhostw.exe
-
Size
44.5MB
-
Sample
220823-zp8h3acfa6
-
MD5
c80de2166e297418ceac6dd1e3733f09
-
SHA1
e4bd7d38e3dc7ca0d9b85d2b20b7a9f012ea1a82
-
SHA256
4116562a1ee0fa7fc1119971b1c73afca0bb4e45104948d3b61303fbbab64660
-
SHA512
27a85b4e16953fc83160cc76557855624e1780ac62aeae46d98a6b0a117772122c60e08d707ed29ad6e2d7a66f47eec45abc03634efd5cf555834df423866f85
-
SSDEEP
786432:cgJ9RzMFawRf0ac415LIzsW0w/+bm+5qGwMEeBkmM3g6F388qkEfEs8Ne7Ctwy:cGMYO+4hw/+r03MEeBNIT388va5WWy
Behavioral task
behavioral1
Sample
taskhostw.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
taskhostw.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
taskhostw.exe
-
Size
44.5MB
-
MD5
c80de2166e297418ceac6dd1e3733f09
-
SHA1
e4bd7d38e3dc7ca0d9b85d2b20b7a9f012ea1a82
-
SHA256
4116562a1ee0fa7fc1119971b1c73afca0bb4e45104948d3b61303fbbab64660
-
SHA512
27a85b4e16953fc83160cc76557855624e1780ac62aeae46d98a6b0a117772122c60e08d707ed29ad6e2d7a66f47eec45abc03634efd5cf555834df423866f85
-
SSDEEP
786432:cgJ9RzMFawRf0ac415LIzsW0w/+bm+5qGwMEeBkmM3g6F388qkEfEs8Ne7Ctwy:cGMYO+4hw/+r03MEeBNIT388va5WWy
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Drops file in Drivers directory
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-