eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3

General

Target

eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe
Size

156KB
MD5

ff9bfccf824dc72fe7b494f780d393a5
SHA1

8a25cafc0657f57c4bfafd6f63cf68a1449721c9
SHA256

eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3
SHA512

eda7c64429a15e92cc8cda4808453c9542277a7e0f82a62bc355c108c82b05a293cefee828b916fcb6854684a216834a20fe0c2b4091aa12f8860b810af6bc1e
SSDEEP

3072:N46Wg5XuwIFjVgW4XMI0KnS+6nPh4eH1OS5:NqxYWMiXPmY

Score

9^/10

evasion persistence

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	notepad.exe

Executes dropped EXE 1 IoCs

pid	Process
1320	notepad.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	notepad.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	notepad.exe

Loads dropped DLL 1 IoCs

pid	Process
1428	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\notepad.exe = "C:\\Users\\Admin\\AppData\\Roaming\\alFSVWJB\\notepad.exe"	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe
Token: SeDebugPrivilege	1320	notepad.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1320	1428	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe	27
PID 1428 wrote to memory of 1320	1428	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe	27
PID 1428 wrote to memory of 1320	1428	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe	27
PID 1428 wrote to memory of 1320	1428	eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe	27

C:\Users\Admin\AppData\Local\Temp\eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe
"C:\Users\Admin\AppData\Local\Temp\eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Roaming\alFSVWJB\notepad.exe
  C:\Users\Admin\AppData\Roaming\alFSVWJB\notepad.exe
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Executes dropped EXE
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\alFSVWJB\notepad.exe

Filesize
156KB

MD5
ff9bfccf824dc72fe7b494f780d393a5

SHA1
8a25cafc0657f57c4bfafd6f63cf68a1449721c9

SHA256
eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3

SHA512
eda7c64429a15e92cc8cda4808453c9542277a7e0f82a62bc355c108c82b05a293cefee828b916fcb6854684a216834a20fe0c2b4091aa12f8860b810af6bc1e

Download Submit
\Users\Admin\AppData\Roaming\alFSVWJB\notepad.exe

Filesize
156KB

MD5
ff9bfccf824dc72fe7b494f780d393a5

SHA1
8a25cafc0657f57c4bfafd6f63cf68a1449721c9

SHA256
eece5634f533c0552524156b941ff3efc227b938d740517875de4a6cf372b9b3

SHA512
eda7c64429a15e92cc8cda4808453c9542277a7e0f82a62bc355c108c82b05a293cefee828b916fcb6854684a216834a20fe0c2b4091aa12f8860b810af6bc1e

Download Submit
memory/1320-62-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1320-63-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1428-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1428-55-0x0000000000250000-0x0000000000258000-memory.dmp

Filesize
32KB

Download
memory/1428-56-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1428-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads