Analysis
-
max time kernel
71s -
max time network
75s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
03-10-2022 03:04
Static task
static1
General
-
Target
79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe
-
Size
1.8MB
-
MD5
2e0861f46d2ad2200856d84dff8d7e55
-
SHA1
5a6410e2d9e6428c724156b222f4e15a8dff21c2
-
SHA256
79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559
-
SHA512
941b224f89a98986f3272ea244ca544f4b0e3c97b17108aa4e0b371e0d712d28d3293632577334b54820d9bd49dd0b243988aca95aaa7bd6f3f6bc4ab90a276c
-
SSDEEP
49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Executes dropped EXE 1 IoCs
Processes:
oobeldr.exepid process 2912 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe -
Processes:
79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exeoobeldr.exepid process 2492 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe 2492 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe 2912 oobeldr.exe 2912 oobeldr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2780 schtasks.exe 5080 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exeoobeldr.exepid process 2492 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe 2492 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe 2492 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe 2492 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe 2912 oobeldr.exe 2912 oobeldr.exe 2912 oobeldr.exe 2912 oobeldr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exeoobeldr.exedescription pid process target process PID 2492 wrote to memory of 2780 2492 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe schtasks.exe PID 2492 wrote to memory of 2780 2492 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe schtasks.exe PID 2492 wrote to memory of 2780 2492 79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe schtasks.exe PID 2912 wrote to memory of 5080 2912 oobeldr.exe schtasks.exe PID 2912 wrote to memory of 5080 2912 oobeldr.exe schtasks.exe PID 2912 wrote to memory of 5080 2912 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe"C:\Users\Admin\AppData\Local\Temp\79ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD52e0861f46d2ad2200856d84dff8d7e55
SHA15a6410e2d9e6428c724156b222f4e15a8dff21c2
SHA25679ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559
SHA512941b224f89a98986f3272ea244ca544f4b0e3c97b17108aa4e0b371e0d712d28d3293632577334b54820d9bd49dd0b243988aca95aaa7bd6f3f6bc4ab90a276c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD52e0861f46d2ad2200856d84dff8d7e55
SHA15a6410e2d9e6428c724156b222f4e15a8dff21c2
SHA25679ddccea3a28e131458edc499d2b50fcf111b799cbf4d66f653dd89216b09559
SHA512941b224f89a98986f3272ea244ca544f4b0e3c97b17108aa4e0b371e0d712d28d3293632577334b54820d9bd49dd0b243988aca95aaa7bd6f3f6bc4ab90a276c
-
memory/2492-158-0x0000000000C70000-0x0000000000F8F000-memory.dmpFilesize
3.1MB
-
memory/2492-120-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-122-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-123-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-124-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-125-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-126-0x0000000000C70000-0x0000000000F8F000-memory.dmpFilesize
3.1MB
-
memory/2492-127-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-129-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-128-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-130-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-131-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-132-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-133-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-134-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-135-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-136-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-137-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-138-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-139-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-140-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-141-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-142-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-143-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-144-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-145-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-146-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-148-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-147-0x0000000002E80000-0x0000000002EC4000-memory.dmpFilesize
272KB
-
memory/2492-149-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-150-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-151-0x0000000000C70000-0x0000000000F8F000-memory.dmpFilesize
3.1MB
-
memory/2492-152-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-153-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-154-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-156-0x0000000000C70000-0x0000000000F8F000-memory.dmpFilesize
3.1MB
-
memory/2492-155-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-157-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-164-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-159-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-121-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-161-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-162-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-163-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-160-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-165-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-166-0x0000000000C71000-0x0000000000C73000-memory.dmpFilesize
8KB
-
memory/2492-167-0x0000000000C71000-0x0000000000C73000-memory.dmpFilesize
8KB
-
memory/2492-168-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-169-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-177-0x0000000000C70000-0x0000000000F8F000-memory.dmpFilesize
3.1MB
-
memory/2492-190-0x0000000000C70000-0x0000000000F8F000-memory.dmpFilesize
3.1MB
-
memory/2492-191-0x0000000002E80000-0x0000000002EC4000-memory.dmpFilesize
272KB
-
memory/2780-189-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-182-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-188-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-173-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-174-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-175-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-178-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-176-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-179-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-180-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-181-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-183-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-172-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-171-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-185-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-186-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-187-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-184-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2780-170-0x0000000000000000-mapping.dmp
-
memory/2912-224-0x0000000000E50000-0x000000000116F000-memory.dmpFilesize
3.1MB
-
memory/2912-225-0x0000000000DC0000-0x0000000000E04000-memory.dmpFilesize
272KB
-
memory/2912-226-0x0000000000E50000-0x000000000116F000-memory.dmpFilesize
3.1MB
-
memory/2912-259-0x0000000000E50000-0x000000000116F000-memory.dmpFilesize
3.1MB
-
memory/2912-262-0x0000000000E50000-0x000000000116F000-memory.dmpFilesize
3.1MB
-
memory/2912-261-0x0000000000DC0000-0x0000000000E04000-memory.dmpFilesize
272KB
-
memory/2912-260-0x0000000000E50000-0x000000000116F000-memory.dmpFilesize
3.1MB
-
memory/5080-240-0x0000000000000000-mapping.dmp