Analysis
-
max time kernel
50s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03-10-2022 06:21
Static task
static1
General
-
Target
542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe
-
Size
1.8MB
-
MD5
2f3d9af858d7fcf8cd6cd2f2739ea8cb
-
SHA1
bcce478094cdcea3cc31d460a4381524113a87d5
-
SHA256
542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947
-
SHA512
626ac19c5192b30c41475bed1faaa8600db6b9c1312c93cdb6536d474d07ee3c760053b8ebd643752e2359873dc5aeeb954f92f9df64b64e69bed9b7bfbc91ad
-
SSDEEP
49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Executes dropped EXE 1 IoCs
Processes:
oobeldr.exepid process 4600 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe -
Processes:
542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exeoobeldr.exepid process 2660 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe 2660 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe 4600 oobeldr.exe 4600 oobeldr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exeoobeldr.exepid process 2660 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe 2660 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe 2660 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe 2660 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe 4600 oobeldr.exe 4600 oobeldr.exe 4600 oobeldr.exe 4600 oobeldr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exeoobeldr.exedescription pid process target process PID 2660 wrote to memory of 3636 2660 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe schtasks.exe PID 2660 wrote to memory of 3636 2660 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe schtasks.exe PID 2660 wrote to memory of 3636 2660 542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe schtasks.exe PID 4600 wrote to memory of 812 4600 oobeldr.exe schtasks.exe PID 4600 wrote to memory of 812 4600 oobeldr.exe schtasks.exe PID 4600 wrote to memory of 812 4600 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe"C:\Users\Admin\AppData\Local\Temp\542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD52f3d9af858d7fcf8cd6cd2f2739ea8cb
SHA1bcce478094cdcea3cc31d460a4381524113a87d5
SHA256542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947
SHA512626ac19c5192b30c41475bed1faaa8600db6b9c1312c93cdb6536d474d07ee3c760053b8ebd643752e2359873dc5aeeb954f92f9df64b64e69bed9b7bfbc91ad
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
1.8MB
MD52f3d9af858d7fcf8cd6cd2f2739ea8cb
SHA1bcce478094cdcea3cc31d460a4381524113a87d5
SHA256542df6c6398bb88f514801773847057d2d492a52e2ea97836704f073c5a4b947
SHA512626ac19c5192b30c41475bed1faaa8600db6b9c1312c93cdb6536d474d07ee3c760053b8ebd643752e2359873dc5aeeb954f92f9df64b64e69bed9b7bfbc91ad
-
memory/812-239-0x0000000000000000-mapping.dmp
-
memory/2660-120-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-122-0x0000000000DE0000-0x00000000010FF000-memory.dmpFilesize
3.1MB
-
memory/2660-121-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-123-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-124-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-125-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-126-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-127-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-128-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-129-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-130-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-131-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-132-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-133-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-134-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-135-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-136-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-137-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-138-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-139-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-140-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-141-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-142-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-143-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-144-0x0000000001100000-0x00000000011AE000-memory.dmpFilesize
696KB
-
memory/2660-145-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-146-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-147-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-148-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-149-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-150-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-151-0x0000000000DE0000-0x00000000010FF000-memory.dmpFilesize
3.1MB
-
memory/2660-152-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-153-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-154-0x0000000000DE0000-0x00000000010FF000-memory.dmpFilesize
3.1MB
-
memory/2660-155-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-156-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-157-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-158-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-159-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-160-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-161-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-162-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-163-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-164-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-165-0x0000000000DE1000-0x0000000000DE3000-memory.dmpFilesize
8KB
-
memory/2660-166-0x0000000000DE1000-0x0000000000DE3000-memory.dmpFilesize
8KB
-
memory/2660-167-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-168-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/2660-169-0x0000000000DE0000-0x00000000010FF000-memory.dmpFilesize
3.1MB
-
memory/2660-170-0x0000000000DE0000-0x00000000010FF000-memory.dmpFilesize
3.1MB
-
memory/2660-190-0x0000000000DE0000-0x00000000010FF000-memory.dmpFilesize
3.1MB
-
memory/3636-171-0x0000000000000000-mapping.dmp
-
memory/3636-172-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-173-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-174-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-175-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-176-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-177-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-178-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-179-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-180-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-181-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-182-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-183-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-184-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-185-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-186-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-187-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-188-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/3636-189-0x0000000077730000-0x00000000778BE000-memory.dmpFilesize
1.6MB
-
memory/4600-233-0x0000000001040000-0x000000000135F000-memory.dmpFilesize
3.1MB
-
memory/4600-234-0x0000000000860000-0x00000000009AA000-memory.dmpFilesize
1.3MB
-
memory/4600-235-0x0000000001040000-0x000000000135F000-memory.dmpFilesize
3.1MB
-
memory/4600-258-0x0000000001040000-0x000000000135F000-memory.dmpFilesize
3.1MB
-
memory/4600-259-0x0000000000860000-0x00000000009AA000-memory.dmpFilesize
1.3MB