b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4

Analysis

max time kernel
114s
max time network
217s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe
Size

1.3MB
MD5

615d1137ea8dff5bc2e32500509da5a1
SHA1

d210e5f9ac887cc9a4706c89cd3728b14dd7e996
SHA256

b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4
SHA512

40c956ca9dac2d12479686a01671e1f275f09cd2ee61d01a3c0d9c83d8346ff643408eb4b753d2b60ce1aeb103607ea9e7780e9a5843dd6b7ee5256fde029f66
SSDEEP

24576:hf+KPyNSARNj7IwbjcLxSBFOWbmCDBvuVCOb5bjnP+XRJXgvvDtVEjEYR0vLwkF:v6NSuRtcLEBFOCmCDdAJwYHDDEfRro

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Wine	b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

pid process

1668 b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?26386"	b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

pid process

1668 b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

pid	process
1668	b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe
1668	b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe

C:\Users\Admin\AppData\Local\Temp\b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe
"C:\Users\Admin\AppData\Local\Temp\b7b742027f7dba7c2ca936e69650f21f1e2c249698bbff40f70cedb0783990a4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-54-0x0000000000400000-0x000000000073F000-memory.dmp

Filesize
3.2MB

Download
memory/1668-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1668-56-0x00000000770A0000-0x0000000077220000-memory.dmp

Filesize
1.5MB

Download
memory/1668-57-0x0000000000400000-0x000000000073F000-memory.dmp

Filesize
3.2MB

Download
memory/1668-58-0x0000000000400000-0x000000000073F000-memory.dmp

Filesize
3.2MB

Download
memory/1668-59-0x00000000770A0000-0x0000000077220000-memory.dmp

Filesize
1.5MB

Download
memory/1668-60-0x0000000000400000-0x000000000073F000-memory.dmp

Filesize
3.2MB

Download
memory/1668-61-0x0000000000400000-0x000000000073F000-memory.dmp

Filesize
3.2MB

Download
memory/1668-62-0x00000000770A0000-0x0000000077220000-memory.dmp

Filesize
1.5MB

Download