Analysis
-
max time kernel
131s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 16:11
Static task
static1
Behavioral task
behavioral1
Sample
c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe
Resource
win10v2004-20220901-en
General
-
Target
c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe
-
Size
159KB
-
MD5
f35d5b7f3334a3eea993547a319bd6cd
-
SHA1
dad10e0c1b97cf720e81a10edde8a468990ca140
-
SHA256
c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697
-
SHA512
7653eccb47378399d45ab6a8d19df73e1e1e3bb03d42db8dc2b83856b12e2255522cbc02084dd06b2f22602b0d0b82a28dda5e74c569fd7e8bab3fc0c0a47fd4
-
SSDEEP
3072:mVtnIr8svE4OoqSwL+avJ8se/CLtHFy4GXdjIMIXBEIx2Dcx:DbqS09LJFyPNjUXB5UG
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
Processes:
c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exenotepad.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions notepad.exe -
Executes dropped EXE 1 IoCs
Processes:
notepad.exepid process 576 notepad.exe -
Looks for VMWare Tools registry key 2 TTPs 2 IoCs
Processes:
c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exenotepad.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools notepad.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exenotepad.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion notepad.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exepid process 1236 c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe 1236 c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\notepad.exe = "C:\\Users\\Admin\\AppData\\Roaming\\alFSVWJB\\notepad.exe" c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exenotepad.exedescription pid process Token: SeDebugPrivilege 1236 c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe Token: SeDebugPrivilege 576 notepad.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exedescription pid process target process PID 1236 wrote to memory of 576 1236 c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe notepad.exe PID 1236 wrote to memory of 576 1236 c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe notepad.exe PID 1236 wrote to memory of 576 1236 c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe notepad.exe PID 1236 wrote to memory of 576 1236 c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe"C:\Users\Admin\AppData\Local\Temp\c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\alFSVWJB\notepad.exeC:\Users\Admin\AppData\Roaming\alFSVWJB\notepad.exe2⤵
- Looks for VirtualBox Guest Additions in registry
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\alFSVWJB\notepad.exeFilesize
159KB
MD5f35d5b7f3334a3eea993547a319bd6cd
SHA1dad10e0c1b97cf720e81a10edde8a468990ca140
SHA256c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697
SHA5127653eccb47378399d45ab6a8d19df73e1e1e3bb03d42db8dc2b83856b12e2255522cbc02084dd06b2f22602b0d0b82a28dda5e74c569fd7e8bab3fc0c0a47fd4
-
\Users\Admin\AppData\Roaming\alFSVWJB\notepad.exeFilesize
159KB
MD5f35d5b7f3334a3eea993547a319bd6cd
SHA1dad10e0c1b97cf720e81a10edde8a468990ca140
SHA256c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697
SHA5127653eccb47378399d45ab6a8d19df73e1e1e3bb03d42db8dc2b83856b12e2255522cbc02084dd06b2f22602b0d0b82a28dda5e74c569fd7e8bab3fc0c0a47fd4
-
\Users\Admin\AppData\Roaming\alFSVWJB\notepad.exeFilesize
159KB
MD5f35d5b7f3334a3eea993547a319bd6cd
SHA1dad10e0c1b97cf720e81a10edde8a468990ca140
SHA256c98631ac5f43c7b1d45fedc2c8d54696860b92ed73a28376c200508b4a67f697
SHA5127653eccb47378399d45ab6a8d19df73e1e1e3bb03d42db8dc2b83856b12e2255522cbc02084dd06b2f22602b0d0b82a28dda5e74c569fd7e8bab3fc0c0a47fd4
-
memory/576-59-0x0000000000000000-mapping.dmp
-
memory/576-63-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/576-64-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/1236-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/1236-55-0x0000000000250000-0x0000000000258000-memory.dmpFilesize
32KB
-
memory/1236-56-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB
-
memory/1236-60-0x0000000000400000-0x000000000043B000-memory.dmpFilesize
236KB