47d63263c92d312d2bbebddeb5a937454397984a5f738fb0e3093b5de3c6827e

Analysis

max time kernel
151s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Game.exe
Size

2.1MB
MD5

3eb620f96ca44c7329bcbed65f5e800d
SHA1

3b86f11827ccda84cfa6fd6df76987f7bcf740b2
SHA256

699732dd6c9f7d5fbb40fb45e7b1009121e6edab3b6f3438cb5e79a724d6fdff
SHA512

7fd0636176dac4e8405824d4d7dd923b1fe3e5799bd46eef00eee60576c34527afe1f8874fb22c1ecc53e77bd5aee9ef66f5904179bbb48456e5eb1bd5061edd
SSDEEP

49152:OZWjXuitIvNv8JrhwFcAxBzfjIqFgaStjMks2YSzsAo0ItUOua:OkjXuUIVv8ltt9Y30rOu

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Game.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Wine	Game.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2412	Game.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	Game.exe
2412	Game.exe

C:\Users\Admin\AppData\Local\Temp\Game.exe
"C:\Users\Admin\AppData\Local\Temp\Game.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-132-0x0000000000400000-0x0000000002403000-memory.dmp

Filesize
32.0MB

Download
memory/2412-133-0x0000000077330000-0x00000000774D3000-memory.dmp

Filesize
1.6MB

Download
memory/2412-134-0x0000000000400000-0x0000000002403000-memory.dmp

Filesize
32.0MB

Download
memory/2412-135-0x0000000077330000-0x00000000774D3000-memory.dmp

Filesize
1.6MB

Download