Analysis
-
max time kernel
53s -
max time network
73s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 05:00
Static task
static1
General
-
Target
99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe
-
Size
1.8MB
-
MD5
cff185422e7c7db9a239569c119b0691
-
SHA1
6162208c698eee0ec6b3c02aef9d72e58e8bbb1b
-
SHA256
99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044
-
SHA512
4ab59fda4765384c0b2c9e2ac168402523c7123b2f3033b9ba9678ed6bd1bfd4d18eb354a01ba502f99b2648b1dc263b52c61d1d9868fb9f31b8e6a0e8e2f83d
-
SSDEEP
49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Executes dropped EXE 1 IoCs
Processes:
oobeldr.exepid process 3968 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe -
Processes:
99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exeoobeldr.exepid process 2832 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe 2832 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe 3968 oobeldr.exe 3968 oobeldr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2024 schtasks.exe 4924 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exeoobeldr.exepid process 2832 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe 2832 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe 2832 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe 2832 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe 3968 oobeldr.exe 3968 oobeldr.exe 3968 oobeldr.exe 3968 oobeldr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exeoobeldr.exedescription pid process target process PID 2832 wrote to memory of 2024 2832 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe schtasks.exe PID 2832 wrote to memory of 2024 2832 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe schtasks.exe PID 2832 wrote to memory of 2024 2832 99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe schtasks.exe PID 3968 wrote to memory of 4924 3968 oobeldr.exe schtasks.exe PID 3968 wrote to memory of 4924 3968 oobeldr.exe schtasks.exe PID 3968 wrote to memory of 4924 3968 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe"C:\Users\Admin\AppData\Local\Temp\99febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD5cff185422e7c7db9a239569c119b0691
SHA16162208c698eee0ec6b3c02aef9d72e58e8bbb1b
SHA25699febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044
SHA5124ab59fda4765384c0b2c9e2ac168402523c7123b2f3033b9ba9678ed6bd1bfd4d18eb354a01ba502f99b2648b1dc263b52c61d1d9868fb9f31b8e6a0e8e2f83d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD5cff185422e7c7db9a239569c119b0691
SHA16162208c698eee0ec6b3c02aef9d72e58e8bbb1b
SHA25699febd4c40fd95d29fc215c9281ad5a0c05ae7821ff5c2ddbf3ccf15d9300044
SHA5124ab59fda4765384c0b2c9e2ac168402523c7123b2f3033b9ba9678ed6bd1bfd4d18eb354a01ba502f99b2648b1dc263b52c61d1d9868fb9f31b8e6a0e8e2f83d
-
memory/2024-176-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-183-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-182-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-181-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-178-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-180-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-179-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-177-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-165-0x0000000000000000-mapping.dmp
-
memory/2024-175-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-174-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-170-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-173-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-172-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-171-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-168-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-169-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-166-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2024-167-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-134-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-136-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-138-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-139-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-140-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-142-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-141-0x0000000002B90000-0x0000000002BD4000-memory.dmpFilesize
272KB
-
memory/2832-143-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-145-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-144-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-146-0x0000000000D30000-0x000000000104F000-memory.dmpFilesize
3.1MB
-
memory/2832-147-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-148-0x0000000000D30000-0x000000000104F000-memory.dmpFilesize
3.1MB
-
memory/2832-149-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-150-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-151-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-152-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-153-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-154-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-155-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-156-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-157-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-158-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-159-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-161-0x0000000000D31000-0x0000000000D33000-memory.dmpFilesize
8KB
-
memory/2832-160-0x0000000000D30000-0x000000000104F000-memory.dmpFilesize
3.1MB
-
memory/2832-162-0x0000000000D31000-0x0000000000D33000-memory.dmpFilesize
8KB
-
memory/2832-163-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-164-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-137-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-135-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-115-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-133-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-132-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-131-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-130-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-126-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-129-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-128-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-127-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-125-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-124-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-122-0x0000000000D30000-0x000000000104F000-memory.dmpFilesize
3.1MB
-
memory/2832-123-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-120-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-121-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-119-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-118-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-185-0x0000000002B90000-0x0000000002BD4000-memory.dmpFilesize
272KB
-
memory/2832-184-0x0000000000D30000-0x000000000104F000-memory.dmpFilesize
3.1MB
-
memory/2832-117-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-116-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/3968-232-0x0000000001110000-0x000000000142F000-memory.dmpFilesize
3.1MB
-
memory/3968-233-0x0000000000920000-0x0000000000A6A000-memory.dmpFilesize
1.3MB
-
memory/3968-234-0x0000000001110000-0x000000000142F000-memory.dmpFilesize
3.1MB
-
memory/3968-253-0x0000000001110000-0x000000000142F000-memory.dmpFilesize
3.1MB
-
memory/3968-254-0x0000000000920000-0x0000000000A6A000-memory.dmpFilesize
1.3MB
-
memory/4924-231-0x0000000000000000-mapping.dmp