1379fd67588484b8817a50e5fdfb37ced156e44b3a4f0fdd466409e481733ef5

Analysis

max time kernel
94s
max time network
203s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ʹ֮/ƶ.exe
Size

1.9MB
MD5

91c5458de692794b06f4a9325d05d54c
SHA1

57a6bb11434383fd92c84337672035db16c451a3
SHA256

de3a14f92fac837c5e7017a694de2583efeea11d514c78cec3d8dcc43742386d
SHA512

4ffd77afc3d71001f80b991c38a487ccfa7a72f342d493ee17af0036defbbc606340c015a6f4cc5745bc4d7c21c1926ea7f5a060df1ade2ef594b140b78fc641
SSDEEP

24576:eABVT3dYPhwBC+vzC8ZgwC0PtdrGd6ppOTEwb+KeZQgw/bPg+IYYljK3qOTUPQC+:eYd2hwBC+vzC8Z/LrGcpEmM3qOTMdtL

Score

9^/10

evasion upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

ƶ.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ƶ.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ƶ.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral13/memory/1748-57-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-59-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-58-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-61-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-63-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-65-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-67-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-69-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-71-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-73-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-75-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-79-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-77-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-85-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-81-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-87-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-89-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-91-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-95-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-93-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-99-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-97-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-101-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral13/memory/1748-106-0x0000000010000000-0x000000001003F000-memory.dmp	upx

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

ƶ.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Wine ƶ.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ƶ.exe

pid process

1748 ƶ.exe
Drops file in Windows directory 1 IoCs

Processes:

ƶ.exe

description ioc process

File opened for modification C:\Windows\ ƶ.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ƶ.exe

pid process

1748 ƶ.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

ƶ.exe

pid process

1748 ƶ.exe
1748 ƶ.exe
1748 ƶ.exe
1748 ƶ.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Wine	ƶ.exe

pid	process
1748	ƶ.exe

description	ioc	process
File opened for modification	C:\Windows\	ƶ.exe

pid	process
1748	ƶ.exe

pid	process
1748	ƶ.exe
1748	ƶ.exe
1748	ƶ.exe
1748	ƶ.exe

C:\Users\Admin\AppData\Local\Temp\ʹ֮\ƶ.exe
"C:\Users\Admin\AppData\Local\Temp\ʹ֮\ƶ.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-54-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1748-55-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1748-56-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1748-57-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-59-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-58-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-61-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-63-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-65-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-67-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-69-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-71-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-73-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-75-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-79-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-77-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-84-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1748-85-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-82-0x0000000077460000-0x00000000775E0000-memory.dmp

Filesize
1.5MB

Download
memory/1748-81-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-87-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-89-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-91-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-95-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-93-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-99-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-97-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-101-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1748-102-0x0000000004B20000-0x0000000004B55000-memory.dmp

Filesize
212KB

Download
memory/1748-104-0x0000000077460000-0x00000000775E0000-memory.dmp

Filesize
1.5MB

Download
memory/1748-105-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/1748-106-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download