a04fc6b08a0e0ce19c761f400e372de77435a491416c55bfa9abcf7b6adb51e3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a04fc6b08a0e0ce19c761f400e372de77435a491416c55bfa9abcf7b6adb51e3
Size

268KB
Sample

221127-x35yzsgd21
MD5

8caf18e57098e87d1fbf7c408fd5ab5f
SHA1

8649905f4a3ea9cb843b20b80b4b26d5a1851e6f
SHA256

a04fc6b08a0e0ce19c761f400e372de77435a491416c55bfa9abcf7b6adb51e3
SHA512

a0eba9a639aed4029b4bc2d23681bbf32d14e93cefaf4ee5081f6b44af71b16b19e1f8fcfe135b3afb62d69b8d26f1dfe28ed6fac5479517a75e47a52fe905e3
SSDEEP

6144:IQwhv/+xycU3gcMVbZ1IKohhvwnLMTq9i:BY/+xyJ3gcMVnXloTq9i

Score

9^/10

evasion persistence

Malware Config

Targets

- Target
  
  a04fc6b08a0e0ce19c761f400e372de77435a491416c55bfa9abcf7b6adb51e3
- Size
  
  268KB
- MD5
  
  8caf18e57098e87d1fbf7c408fd5ab5f
- SHA1
  
  8649905f4a3ea9cb843b20b80b4b26d5a1851e6f
- SHA256
  
  a04fc6b08a0e0ce19c761f400e372de77435a491416c55bfa9abcf7b6adb51e3
- SHA512
  
  a0eba9a639aed4029b4bc2d23681bbf32d14e93cefaf4ee5081f6b44af71b16b19e1f8fcfe135b3afb62d69b8d26f1dfe28ed6fac5479517a75e47a52fe905e3
- SSDEEP
  
  6144:IQwhv/+xycU3gcMVbZ1IKohhvwnLMTq9i:BY/+xyJ3gcMVnXloTq9i
Score

9^/10

evasion persistence
- Looks for VirtualBox Guest Additions in registry
  evasion
- Executes dropped EXE
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2