Analysis

  • max time kernel
    91s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2022, 15:13

General

  • Target

    d5646d4d558533e0e23f4715c0679f6b5c8c6d14e86a32027d809379b6894c35.exe

  • Size

    1.8MB

  • MD5

    0ef34ab6a825460fc7f38e206cc1ffb6

  • SHA1

    38f87b6e01e297820e41f45b786299f837a6f6af

  • SHA256

    d5646d4d558533e0e23f4715c0679f6b5c8c6d14e86a32027d809379b6894c35

  • SHA512

    0cf6d54eca1be7077d0d97564847323237eb946c387cef6181110f190ade9ed567382a06ab54753402861a158a7fe0e6e96b3875172bf0dfd4c748a52275433d

  • SSDEEP

    49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5646d4d558533e0e23f4715c0679f6b5c8c6d14e86a32027d809379b6894c35.exe
    "C:\Users\Admin\AppData\Local\Temp\d5646d4d558533e0e23f4715c0679f6b5c8c6d14e86a32027d809379b6894c35.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2672
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4752
  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4528
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2212

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

          Filesize

          1.8MB

          MD5

          0ef34ab6a825460fc7f38e206cc1ffb6

          SHA1

          38f87b6e01e297820e41f45b786299f837a6f6af

          SHA256

          d5646d4d558533e0e23f4715c0679f6b5c8c6d14e86a32027d809379b6894c35

          SHA512

          0cf6d54eca1be7077d0d97564847323237eb946c387cef6181110f190ade9ed567382a06ab54753402861a158a7fe0e6e96b3875172bf0dfd4c748a52275433d

        • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

          Filesize

          1.8MB

          MD5

          0ef34ab6a825460fc7f38e206cc1ffb6

          SHA1

          38f87b6e01e297820e41f45b786299f837a6f6af

          SHA256

          d5646d4d558533e0e23f4715c0679f6b5c8c6d14e86a32027d809379b6894c35

          SHA512

          0cf6d54eca1be7077d0d97564847323237eb946c387cef6181110f190ade9ed567382a06ab54753402861a158a7fe0e6e96b3875172bf0dfd4c748a52275433d

        • memory/2672-137-0x0000000000611000-0x0000000000613000-memory.dmp

          Filesize

          8KB

        • memory/2672-136-0x0000000000611000-0x0000000000613000-memory.dmp

          Filesize

          8KB

        • memory/2672-132-0x0000000000610000-0x000000000092F000-memory.dmp

          Filesize

          3.1MB

        • memory/2672-133-0x0000000000BB0000-0x0000000000BF4000-memory.dmp

          Filesize

          272KB

        • memory/2672-139-0x0000000000610000-0x000000000092F000-memory.dmp

          Filesize

          3.1MB

        • memory/2672-140-0x0000000000BB0000-0x0000000000BF4000-memory.dmp

          Filesize

          272KB

        • memory/2672-141-0x0000000077520000-0x00000000776C3000-memory.dmp

          Filesize

          1.6MB

        • memory/2672-135-0x0000000000610000-0x000000000092F000-memory.dmp

          Filesize

          3.1MB

        • memory/2672-134-0x0000000000610000-0x000000000092F000-memory.dmp

          Filesize

          3.1MB

        • memory/4528-144-0x0000000000AC0000-0x0000000000DDF000-memory.dmp

          Filesize

          3.1MB

        • memory/4528-146-0x0000000000AC1000-0x0000000000AC3000-memory.dmp

          Filesize

          8KB

        • memory/4528-148-0x0000000000AC0000-0x0000000000DDF000-memory.dmp

          Filesize

          3.1MB

        • memory/4528-149-0x0000000000A70000-0x0000000000AB4000-memory.dmp

          Filesize

          272KB

        • memory/4528-150-0x0000000000AC0000-0x0000000000DDF000-memory.dmp

          Filesize

          3.1MB

        • memory/4528-151-0x0000000000AC0000-0x0000000000DDF000-memory.dmp

          Filesize

          3.1MB

        • memory/4528-152-0x0000000077520000-0x00000000776C3000-memory.dmp

          Filesize

          1.6MB

        • memory/4528-153-0x0000000000AC0000-0x0000000000DDF000-memory.dmp

          Filesize

          3.1MB

        • memory/4528-154-0x0000000000A70000-0x0000000000AB4000-memory.dmp

          Filesize

          272KB