Analysis
-
max time kernel
185s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe
Resource
win10v2004-20220812-en
General
-
Target
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe
-
Size
110KB
-
MD5
b6790b1c698b844b64c465f3513d5163
-
SHA1
ad0042ed1a2a5ed71abb751d63ecb782947808e4
-
SHA256
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806
-
SHA512
07d6eb4b9a136f7a10ca80f50f873c1f87dba8ba36a8c2adf83008a70567a0e32d049b1ee645f33d71d7369c77f33893fe577f5a19966561806d1f42412c9f5b
-
SSDEEP
3072:y0B2rqrKx6Y19PBHEyMwnJ0XfEg3fjuRrl46q:y0yqU96SJAPjutav
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exedescription pid process target process PID 2240 set thread context of 2100 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exepid process 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exedescription pid process target process PID 2240 wrote to memory of 2100 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 2240 wrote to memory of 2100 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 2240 wrote to memory of 2100 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 2240 wrote to memory of 2100 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 2240 wrote to memory of 2100 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 2240 wrote to memory of 2100 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 2240 wrote to memory of 2100 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe PID 2240 wrote to memory of 2100 2240 d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe"C:\Users\Admin\AppData\Local\Temp\d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe"C:\Users\Admin\AppData\Local\Temp\d87cbb12038ffa3f7b40e95c435d489ef9c43ffe785b8b00cbd9c6397c88a806.exe"2⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2100-132-0x0000000000000000-mapping.dmp
-
memory/2100-133-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2100-136-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2100-137-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2100-138-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/2240-135-0x00000000004F0000-0x00000000004F7000-memory.dmpFilesize
28KB