Analysis
-
max time kernel
92s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2022 06:05
Static task
static1
General
-
Target
f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe
-
Size
1.8MB
-
MD5
8db2b403d740a87e51f390ee83771985
-
SHA1
bf8c39b4b84438f378b7ac6f98f2b5877d123100
-
SHA256
f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141
-
SHA512
118a631524ac21ae26a5b3e49254aa2b9d6ba4ea8ff19eaf11febedbf530c79ceb8bb185dafce2ff0649067af167da4f5b907426e1000d34a47648f74663e7c2
-
SSDEEP
49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Executes dropped EXE 1 IoCs
Processes:
oobeldr.exepid process 4740 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
oobeldr.exef4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe -
Processes:
f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exeoobeldr.exepid process 868 f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe 868 f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe 4740 oobeldr.exe 4740 oobeldr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2636 schtasks.exe 3888 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exeoobeldr.exepid process 868 f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe 868 f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe 868 f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe 868 f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe 4740 oobeldr.exe 4740 oobeldr.exe 4740 oobeldr.exe 4740 oobeldr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exeoobeldr.exedescription pid process target process PID 868 wrote to memory of 3888 868 f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe schtasks.exe PID 868 wrote to memory of 3888 868 f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe schtasks.exe PID 868 wrote to memory of 3888 868 f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe schtasks.exe PID 4740 wrote to memory of 2636 4740 oobeldr.exe schtasks.exe PID 4740 wrote to memory of 2636 4740 oobeldr.exe schtasks.exe PID 4740 wrote to memory of 2636 4740 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe"C:\Users\Admin\AppData\Local\Temp\f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD58db2b403d740a87e51f390ee83771985
SHA1bf8c39b4b84438f378b7ac6f98f2b5877d123100
SHA256f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141
SHA512118a631524ac21ae26a5b3e49254aa2b9d6ba4ea8ff19eaf11febedbf530c79ceb8bb185dafce2ff0649067af167da4f5b907426e1000d34a47648f74663e7c2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD58db2b403d740a87e51f390ee83771985
SHA1bf8c39b4b84438f378b7ac6f98f2b5877d123100
SHA256f4adc3d6e7895aa467b6469c94affda8213742897969aff95ddc480c8a9ac141
SHA512118a631524ac21ae26a5b3e49254aa2b9d6ba4ea8ff19eaf11febedbf530c79ceb8bb185dafce2ff0649067af167da4f5b907426e1000d34a47648f74663e7c2
-
memory/868-144-0x00000000772E0000-0x0000000077483000-memory.dmpFilesize
1.6MB
-
memory/868-132-0x00000000006A0000-0x00000000009BF000-memory.dmpFilesize
3.1MB
-
memory/868-133-0x00000000006A0000-0x00000000009BF000-memory.dmpFilesize
3.1MB
-
memory/868-137-0x00000000006A1000-0x00000000006A3000-memory.dmpFilesize
8KB
-
memory/868-138-0x00000000006A1000-0x00000000006A3000-memory.dmpFilesize
8KB
-
memory/868-139-0x00000000006A0000-0x00000000009BF000-memory.dmpFilesize
3.1MB
-
memory/868-140-0x00000000772E0000-0x0000000077483000-memory.dmpFilesize
1.6MB
-
memory/868-135-0x00000000006A0000-0x00000000009BF000-memory.dmpFilesize
3.1MB
-
memory/868-142-0x00000000006A0000-0x00000000009BF000-memory.dmpFilesize
3.1MB
-
memory/868-143-0x0000000002930000-0x0000000002974000-memory.dmpFilesize
272KB
-
memory/868-136-0x00000000006A0000-0x00000000009BF000-memory.dmpFilesize
3.1MB
-
memory/868-134-0x0000000002930000-0x0000000002974000-memory.dmpFilesize
272KB
-
memory/2636-153-0x0000000000000000-mapping.dmp
-
memory/3888-141-0x0000000000000000-mapping.dmp
-
memory/4740-148-0x0000000001300000-0x0000000001344000-memory.dmpFilesize
272KB
-
memory/4740-149-0x0000000000C60000-0x0000000000F7F000-memory.dmpFilesize
3.1MB
-
memory/4740-150-0x0000000000C60000-0x0000000000F7F000-memory.dmpFilesize
3.1MB
-
memory/4740-147-0x0000000000C60000-0x0000000000F7F000-memory.dmpFilesize
3.1MB
-
memory/4740-152-0x0000000000C61000-0x0000000000C63000-memory.dmpFilesize
8KB
-
memory/4740-154-0x0000000000C60000-0x0000000000F7F000-memory.dmpFilesize
3.1MB
-
memory/4740-155-0x00000000772E0000-0x0000000077483000-memory.dmpFilesize
1.6MB
-
memory/4740-156-0x0000000000C60000-0x0000000000F7F000-memory.dmpFilesize
3.1MB
-
memory/4740-157-0x0000000001300000-0x0000000001344000-memory.dmpFilesize
272KB
-
memory/4740-158-0x0000000000C60000-0x0000000000F7F000-memory.dmpFilesize
3.1MB
-
memory/4740-159-0x0000000000C60000-0x0000000000F7F000-memory.dmpFilesize
3.1MB