d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6

Analysis

max time kernel
64s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe
Size

5.1MB
MD5

811f4faf0423cb1f853185cede912b1a
SHA1

250ba9119da15253f2288ef008545574bde48150
SHA256

d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6
SHA512

87cfe208120c53a15cfa2617821b1013323392158f94a9f7b1b457ae023efbfbd0f78331daff50066f25aac631b8feaabb091ed273623e51e81bd564e2fbe075
SSDEEP

98304:dQaElYj1yRAkBgWsopC8X95avLlrWvGYSQqhn07/Fa6eq+pKktjpqDqLAHd0g2dp:OFghPAEhYhydQ8KW65y16bfGVxNnoU9q

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Wine	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

Loads dropped DLL 1 IoCs

pid	Process
952	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
952	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
952	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe
952	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe
952	d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe

C:\Users\Admin\AppData\Local\Temp\d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe
"C:\Users\Admin\AppData\Local\Temp\d377e8a0f4ff6b7fb19e67692c8905ad409c61a3c2b50a17a5290108ce57e4d6.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\5e8254a0-4dde-4c48-bfb1-5ff4ac254f29\CliSecureRT.dll

Filesize
1.5MB

MD5
a5742879630b4e0677727c7eddd63758

SHA1
a5e3e05876a960258144b55ed2dab167f15cc9ae

SHA256
eef673a6f52b41a2cf69d67b34fc38256fbad0b4838b1e2fcca8543638f0a3b0

SHA512
ad4b5d7b8bce97acb3d2b839b8b8c24124367079a6824ae66da4122d55f3ef0d5e41ab5aa8ec58f3a7c807914ee2c1096f53665b4a37cc508a3875fb1bf71edd

Download Submit
memory/952-54-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/952-55-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/952-57-0x0000000072A60000-0x0000000072D72000-memory.dmp

Filesize
3.1MB

Download
memory/952-58-0x0000000004BA0000-0x0000000004C95000-memory.dmp

Filesize
980KB

Download
memory/952-60-0x0000000077450000-0x00000000775D0000-memory.dmp

Filesize
1.5MB

Download
memory/952-61-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/952-62-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/952-63-0x0000000072A60000-0x0000000072D72000-memory.dmp

Filesize
3.1MB

Download
memory/952-64-0x0000000077450000-0x00000000775D0000-memory.dmp

Filesize
1.5MB

Download