Analysis
-
max time kernel
52s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 00:49
Static task
static1
General
-
Target
95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe
-
Size
1.8MB
-
MD5
dfe10a98f54c09ddd8996ef12adb2ee2
-
SHA1
045696425f01867adc3c71348d80ff382b6b10f6
-
SHA256
95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae
-
SHA512
37f16dd592286f649d2fbc9f3a08f6def24d15d362b5301328e61c6e12b50a5a1501d9461039ffb91f185c37d75ada1984f7cee09e9dbb7f98992be157ec0e87
-
SSDEEP
49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Executes dropped EXE 1 IoCs
Processes:
oobeldr.exepid process 1324 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe -
Processes:
95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exeoobeldr.exepid process 1980 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe 1980 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe 1324 oobeldr.exe 1324 oobeldr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1680 schtasks.exe 2248 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exeoobeldr.exepid process 1980 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe 1980 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe 1980 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe 1980 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe 1324 oobeldr.exe 1324 oobeldr.exe 1324 oobeldr.exe 1324 oobeldr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exeoobeldr.exedescription pid process target process PID 1980 wrote to memory of 1680 1980 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe schtasks.exe PID 1980 wrote to memory of 1680 1980 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe schtasks.exe PID 1980 wrote to memory of 1680 1980 95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe schtasks.exe PID 1324 wrote to memory of 2248 1324 oobeldr.exe schtasks.exe PID 1324 wrote to memory of 2248 1324 oobeldr.exe schtasks.exe PID 1324 wrote to memory of 2248 1324 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe"C:\Users\Admin\AppData\Local\Temp\95dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD5dfe10a98f54c09ddd8996ef12adb2ee2
SHA1045696425f01867adc3c71348d80ff382b6b10f6
SHA25695dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae
SHA51237f16dd592286f649d2fbc9f3a08f6def24d15d362b5301328e61c6e12b50a5a1501d9461039ffb91f185c37d75ada1984f7cee09e9dbb7f98992be157ec0e87
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD5dfe10a98f54c09ddd8996ef12adb2ee2
SHA1045696425f01867adc3c71348d80ff382b6b10f6
SHA25695dec8150b79af203dbc90ed86e6286d105766dc63ed239026523efc8dbef6ae
SHA51237f16dd592286f649d2fbc9f3a08f6def24d15d362b5301328e61c6e12b50a5a1501d9461039ffb91f185c37d75ada1984f7cee09e9dbb7f98992be157ec0e87
-
memory/1324-260-0x00000000008A0000-0x0000000000BBF000-memory.dmpFilesize
3.1MB
-
memory/1324-259-0x00000000007D0000-0x0000000000814000-memory.dmpFilesize
272KB
-
memory/1324-258-0x00000000008A0000-0x0000000000BBF000-memory.dmpFilesize
3.1MB
-
memory/1324-256-0x00000000008A0000-0x0000000000BBF000-memory.dmpFilesize
3.1MB
-
memory/1324-220-0x00000000007D0000-0x0000000000814000-memory.dmpFilesize
272KB
-
memory/1324-219-0x00000000008A0000-0x0000000000BBF000-memory.dmpFilesize
3.1MB
-
memory/1680-185-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-188-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-187-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-186-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-169-0x0000000000000000-mapping.dmp
-
memory/1680-184-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-183-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-182-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-180-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-181-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-179-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-178-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-177-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-176-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-175-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-173-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-172-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-171-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1680-170-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-140-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-174-0x0000000000060000-0x000000000037F000-memory.dmpFilesize
3.1MB
-
memory/1980-149-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-150-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-151-0x0000000000060000-0x000000000037F000-memory.dmpFilesize
3.1MB
-
memory/1980-152-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-153-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-154-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-155-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-157-0x0000000000060000-0x000000000037F000-memory.dmpFilesize
3.1MB
-
memory/1980-158-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-156-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-159-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-160-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-161-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-162-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-163-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-164-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-165-0x0000000000061000-0x0000000000063000-memory.dmpFilesize
8KB
-
memory/1980-166-0x0000000000061000-0x0000000000063000-memory.dmpFilesize
8KB
-
memory/1980-167-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-168-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-147-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-146-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-145-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-144-0x00000000026E0000-0x0000000002724000-memory.dmpFilesize
272KB
-
memory/1980-143-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-148-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-142-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-141-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-120-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-139-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-138-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-137-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-136-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-135-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-134-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-133-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-132-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-131-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-130-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-129-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-189-0x0000000000060000-0x000000000037F000-memory.dmpFilesize
3.1MB
-
memory/1980-190-0x00000000026E0000-0x0000000002724000-memory.dmpFilesize
272KB
-
memory/1980-126-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-128-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-127-0x0000000000060000-0x000000000037F000-memory.dmpFilesize
3.1MB
-
memory/1980-125-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-121-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-124-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-123-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/1980-122-0x0000000077460000-0x00000000775EE000-memory.dmpFilesize
1.6MB
-
memory/2248-238-0x0000000000000000-mapping.dmp