Analysis
-
max time kernel
115s -
max time network
209s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 17:11
Static task
static1
Behavioral task
behavioral1
Sample
a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe
Resource
win10v2004-20220812-en
General
-
Target
a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe
-
Size
1.3MB
-
MD5
5ea2e1377f26539ad90d54e47aa28fbf
-
SHA1
5b5cf6803eb93c5d87981786c04186497ec412e7
-
SHA256
a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714
-
SHA512
d736b949edd6543c3dd34ba29f4c576e24a8b66938ee465845b6bba7619134b1b4324d3b3e661368fa3c29c0d9a9a64f6645acba7e792b25390ad803805cded0
-
SSDEEP
24576:p16QlQCkQU9BSrui3NkBLwCPartrtmbaXWLEIjWxV/Jdq2fv:p119NqieLwCPOt8WvJBf
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Wine a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exepid process 1100 a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?26386" a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exepid process 1100 a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exepid process 1100 a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe 1100 a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe"C:\Users\Admin\AppData\Local\Temp\a21878326e9df5eee4787cff250ae0af8bab15c61e44f454db5f0f50542fa714.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-54-0x0000000000400000-0x0000000000787000-memory.dmpFilesize
3.5MB
-
memory/1100-55-0x0000000075E81000-0x0000000075E83000-memory.dmpFilesize
8KB
-
memory/1100-56-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB
-
memory/1100-57-0x0000000000400000-0x0000000000787000-memory.dmpFilesize
3.5MB
-
memory/1100-58-0x0000000000400000-0x0000000000787000-memory.dmpFilesize
3.5MB
-
memory/1100-59-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB
-
memory/1100-60-0x0000000000400000-0x0000000000787000-memory.dmpFilesize
3.5MB
-
memory/1100-61-0x0000000000400000-0x0000000000787000-memory.dmpFilesize
3.5MB
-
memory/1100-62-0x0000000077300000-0x0000000077480000-memory.dmpFilesize
1.5MB