Analysis
-
max time kernel
161s -
max time network
213s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe
Resource
win10v2004-20220812-en
General
-
Target
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe
-
Size
110KB
-
MD5
b6790b1c698b844b64c465f3513d5163
-
SHA1
ad0042ed1a2a5ed71abb751d63ecb782947808e4
-
SHA256
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806
-
SHA512
07d6eb4b9a136f7a10ca80f50f873c1f87dba8ba36a8c2adf83008a70567a0e32d049b1ee645f33d71d7369c77f33893fe577f5a19966561806d1f42412c9f5b
-
SSDEEP
3072:y0B2rqrKx6Y19PBHEyMwnJ0XfEg3fjuRrl46q:y0yqU96SJAPjutav
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exedescription pid process target process PID 932 set thread context of 1852 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exepid process 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exedescription pid process target process PID 932 wrote to memory of 1852 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 932 wrote to memory of 1852 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 932 wrote to memory of 1852 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 932 wrote to memory of 1852 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 932 wrote to memory of 1852 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 932 wrote to memory of 1852 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 932 wrote to memory of 1852 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 932 wrote to memory of 1852 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 932 wrote to memory of 1852 932 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe"C:\Users\Admin\AppData\Local\Temp\d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe"C:\Users\Admin\AppData\Local\Temp\d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/932-54-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/932-64-0x0000000000220000-0x0000000000227000-memory.dmpFilesize
28KB
-
memory/1852-55-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1852-56-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1852-58-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1852-60-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1852-62-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1852-63-0x000000000040750A-mapping.dmp
-
memory/1852-66-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1852-67-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1852-68-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB