Analysis
-
max time kernel
199s -
max time network
269s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10/11/2022, 22:18
Static task
static1
Behavioral task
behavioral1
Sample
ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe
Resource
win7-20220812-en
General
-
Target
ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe
-
Size
2.3MB
-
MD5
2175015fd052eac3d6feef4e4ad1bd07
-
SHA1
5a2e91427ede9e558c02ee7186ff68aa491d6def
-
SHA256
ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8
-
SHA512
1429ae1523856b4bb2c161204d6394235e7df0c1427202dec7745c814dc22feb06da6b6c0c89aa6fc395a5042357720208a509fccf9a785526a1adb6cf0c6c82
-
SSDEEP
49152:o3O30rzwVzO0foG/EKLlh0JM/zLEQ6vKlB:oy0MOQoG/EKL4JJbKlB
Malware Config
Extracted
systembc
cryptotab.me:4001
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oloi.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oloi.exe -
Executes dropped EXE 2 IoCs
pid Process 1108 oloi.exe 1488 oloi.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oloi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oloi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oloi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oloi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Wine oloi.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Wine ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Wine oloi.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2020 ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe 1108 oloi.exe 1488 oloi.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Tasks\oloi.job ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe File created C:\Windows\Tasks\oloi.job ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2020 ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe 2020 ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe 1108 oloi.exe 1488 oloi.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1296 wrote to memory of 1108 1296 taskeng.exe 29 PID 1296 wrote to memory of 1108 1296 taskeng.exe 29 PID 1296 wrote to memory of 1108 1296 taskeng.exe 29 PID 1296 wrote to memory of 1108 1296 taskeng.exe 29 PID 1296 wrote to memory of 1488 1296 taskeng.exe 30 PID 1296 wrote to memory of 1488 1296 taskeng.exe 30 PID 1296 wrote to memory of 1488 1296 taskeng.exe 30 PID 1296 wrote to memory of 1488 1296 taskeng.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe"C:\Users\Admin\AppData\Local\Temp\ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2020
-
C:\Windows\system32\taskeng.exetaskeng.exe {D866A0C4-298C-4D01-9105-63ACF69D5917} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\ProgramData\uotw\oloi.exeC:\ProgramData\uotw\oloi.exe start22⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
-
C:\ProgramData\uotw\oloi.exeC:\ProgramData\uotw\oloi.exe start22⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1488
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD52175015fd052eac3d6feef4e4ad1bd07
SHA15a2e91427ede9e558c02ee7186ff68aa491d6def
SHA256ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8
SHA5121429ae1523856b4bb2c161204d6394235e7df0c1427202dec7745c814dc22feb06da6b6c0c89aa6fc395a5042357720208a509fccf9a785526a1adb6cf0c6c82
-
Filesize
2.3MB
MD52175015fd052eac3d6feef4e4ad1bd07
SHA15a2e91427ede9e558c02ee7186ff68aa491d6def
SHA256ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8
SHA5121429ae1523856b4bb2c161204d6394235e7df0c1427202dec7745c814dc22feb06da6b6c0c89aa6fc395a5042357720208a509fccf9a785526a1adb6cf0c6c82
-
Filesize
2.3MB
MD52175015fd052eac3d6feef4e4ad1bd07
SHA15a2e91427ede9e558c02ee7186ff68aa491d6def
SHA256ccf4d5167a10a49756ab0cf8a204b5d1a06356b5e9bdbee58f4eda966ec551a8
SHA5121429ae1523856b4bb2c161204d6394235e7df0c1427202dec7745c814dc22feb06da6b6c0c89aa6fc395a5042357720208a509fccf9a785526a1adb6cf0c6c82