eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3 | Triage

Sharing

General

Target

eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3
Size

156KB
Sample

221127-yh1zzahf2t
MD5

ff9bfccf824dc72fe7b494f780d393a5
SHA1

8a25cafc0657f57c4bfafd6f63cf68a1449721c9
SHA256

eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3
SHA512

eda7c64429a15e92cc8cda4808453c9542277a7e0f82a62bc355c108c82b05a293cefee828b916fcb6854684a216834a20fe0c2b4091aa12f8860b810af6bc1e
SSDEEP

3072:N46Wg5XuwIFjVgW4XMI0KnS+6nPh4eH1OS5:NqxYWMiXPmY

Score

9^/10

evasion persistence

Malware Config

Targets

- Target
  
  eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3
- Size
  
  156KB
- MD5
  
  ff9bfccf824dc72fe7b494f780d393a5
- SHA1
  
  8a25cafc0657f57c4bfafd6f63cf68a1449721c9
- SHA256
  
  eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3
- SHA512
  
  eda7c64429a15e92cc8cda4808453c9542277a7e0f82a62bc355c108c82b05a293cefee828b916fcb6854684a216834a20fe0c2b4091aa12f8860b810af6bc1e
- SSDEEP
  
  3072:N46Wg5XuwIFjVgW4XMI0KnS+6nPh4eH1OS5:NqxYWMiXPmY
Score

9^/10

evasion persistence
- Looks for VirtualBox Guest Additions in registry
  evasion
- Executes dropped EXE
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2