Analysis
-
max time kernel
53s -
max time network
62s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 02:24
Static task
static1
General
-
Target
e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe
-
Size
1.8MB
-
MD5
89e60ef2823bfb7e96545ed678ec2817
-
SHA1
5decd2576c0a62999b1c4b81393793ce5f35a207
-
SHA256
e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286
-
SHA512
f3c049a19022e029c259ad363a89aa358b77c56885efff7a46626fcbe1c8d24e016b79a7a85219b640f9e3b9dbc5e9edddb9531eccaf2f6ffc943ed6d9ada351
-
SSDEEP
49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Executes dropped EXE 1 IoCs
Processes:
oobeldr.exepid process 4404 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe -
Processes:
e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exeoobeldr.exepid process 2164 e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe 2164 e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe 4404 oobeldr.exe 4404 oobeldr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4944 schtasks.exe 1284 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exeoobeldr.exepid process 2164 e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe 2164 e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe 2164 e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe 2164 e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe 4404 oobeldr.exe 4404 oobeldr.exe 4404 oobeldr.exe 4404 oobeldr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exeoobeldr.exedescription pid process target process PID 2164 wrote to memory of 4944 2164 e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe schtasks.exe PID 2164 wrote to memory of 4944 2164 e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe schtasks.exe PID 2164 wrote to memory of 4944 2164 e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe schtasks.exe PID 4404 wrote to memory of 1284 4404 oobeldr.exe schtasks.exe PID 4404 wrote to memory of 1284 4404 oobeldr.exe schtasks.exe PID 4404 wrote to memory of 1284 4404 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe"C:\Users\Admin\AppData\Local\Temp\e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD589e60ef2823bfb7e96545ed678ec2817
SHA15decd2576c0a62999b1c4b81393793ce5f35a207
SHA256e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286
SHA512f3c049a19022e029c259ad363a89aa358b77c56885efff7a46626fcbe1c8d24e016b79a7a85219b640f9e3b9dbc5e9edddb9531eccaf2f6ffc943ed6d9ada351
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD589e60ef2823bfb7e96545ed678ec2817
SHA15decd2576c0a62999b1c4b81393793ce5f35a207
SHA256e0ce4f5b17395379d73166ad3a9f9d886b10e9bf2ef87ed909aefdd2cb073286
SHA512f3c049a19022e029c259ad363a89aa358b77c56885efff7a46626fcbe1c8d24e016b79a7a85219b640f9e3b9dbc5e9edddb9531eccaf2f6ffc943ed6d9ada351
-
memory/1284-236-0x0000000000000000-mapping.dmp
-
memory/2164-155-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-169-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-122-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-123-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-124-0x0000000001220000-0x000000000153F000-memory.dmpFilesize
3.1MB
-
memory/2164-125-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-126-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-127-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-128-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-129-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-130-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-131-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-132-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-133-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-134-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-156-0x0000000001220000-0x000000000153F000-memory.dmpFilesize
3.1MB
-
memory/2164-136-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-137-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-138-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-139-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-140-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-141-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-142-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-143-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-144-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-145-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-147-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-146-0x0000000002EE0000-0x0000000002F24000-memory.dmpFilesize
272KB
-
memory/2164-148-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-149-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-150-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-151-0x0000000001220000-0x000000000153F000-memory.dmpFilesize
3.1MB
-
memory/2164-152-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-153-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-154-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-120-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-135-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-157-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-121-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-159-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-160-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-161-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-162-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-163-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-165-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-164-0x0000000001220000-0x000000000153F000-memory.dmpFilesize
3.1MB
-
memory/2164-166-0x0000000001221000-0x0000000001223000-memory.dmpFilesize
8KB
-
memory/2164-167-0x0000000001221000-0x0000000001223000-memory.dmpFilesize
8KB
-
memory/2164-168-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-158-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/2164-189-0x0000000001220000-0x000000000153F000-memory.dmpFilesize
3.1MB
-
memory/2164-190-0x0000000002EE0000-0x0000000002F24000-memory.dmpFilesize
272KB
-
memory/4404-255-0x0000000000DB0000-0x00000000010CF000-memory.dmpFilesize
3.1MB
-
memory/4404-258-0x0000000002BD0000-0x0000000002C14000-memory.dmpFilesize
272KB
-
memory/4404-257-0x0000000000DB0000-0x00000000010CF000-memory.dmpFilesize
3.1MB
-
memory/4404-256-0x0000000002BD0000-0x0000000002C14000-memory.dmpFilesize
272KB
-
memory/4944-176-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-181-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-175-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-177-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-178-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-188-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-186-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-184-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-182-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-170-0x0000000000000000-mapping.dmp
-
memory/4944-174-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-173-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-172-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-171-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-183-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-185-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-180-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-187-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB
-
memory/4944-179-0x00000000776E0000-0x000000007786E000-memory.dmpFilesize
1.6MB