64729a3a7eadd33cad11dc6a215cbcbcc1333b3657cf017f89843a9bae013bcd

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64729a3a7eadd33cad11dc6a215cbcbcc1333b3657cf017f89843a9bae013bcd.dll
Size

825KB
MD5

64f2f85070dfabc3e2304047f6c3baf0
SHA1

816ed51c952e4f1f15560e5449b676180e95b61d
SHA256

64729a3a7eadd33cad11dc6a215cbcbcc1333b3657cf017f89843a9bae013bcd
SHA512

2bbf0fe24450f2a68dea42a6cd350d5cf2f923177ba49ecbe700b519b11d73ab5a535dcd031df0475db2bd2dbe5ac37f3cd20cb2cd432896d0e3814fc06c0047
SSDEEP

12288:OXZ/0ZTnWhZFbHOvulDwLRYjGt50ECxwRvmasNG8RA4Uhv29RbrK9HljLVC3QS:SwqZ9OIDwLRYjGtrXqxsu9hrQjgAS

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	regsvr32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	regsvr32.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Wine	regsvr32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
832	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
832	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 832	828	regsvr32.exe	27
PID 828 wrote to memory of 832	828	regsvr32.exe	27
PID 828 wrote to memory of 832	828	regsvr32.exe	27
PID 828 wrote to memory of 832	828	regsvr32.exe	27
PID 828 wrote to memory of 832	828	regsvr32.exe	27
PID 828 wrote to memory of 832	828	regsvr32.exe	27
PID 828 wrote to memory of 832	828	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\64729a3a7eadd33cad11dc6a215cbcbcc1333b3657cf017f89843a9bae013bcd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\64729a3a7eadd33cad11dc6a215cbcbcc1333b3657cf017f89843a9bae013bcd.dll
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-54-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

Filesize
8KB

Download
memory/832-56-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/832-57-0x0000000010000000-0x00000000101ED000-memory.dmp

Filesize
1.9MB

Download
memory/832-58-0x0000000077960000-0x0000000077AE0000-memory.dmp

Filesize
1.5MB

Download