Analysis

  • max time kernel
    43s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03-12-2022 14:02

General

  • Target

    e087f4ac3f9ccb36c669bc50b280f2c3964057b209c5a92199f42663ba614fe5.exe

  • Size

    1.3MB

  • MD5

    14277c8efd13590a95c48ff8da0ff8b3

  • SHA1

    d48829dd4b3f1c8383a411c7db0653c22f47125c

  • SHA256

    e087f4ac3f9ccb36c669bc50b280f2c3964057b209c5a92199f42663ba614fe5

  • SHA512

    07abe8d63770013e4f5aa001a9808cd7b15f37d5ed84f32d68c027e9d03bad60de327d403b15e214b58e10dea5abbcb9ae33a7d7d3a33d564a79ddb0a10a059b

  • SSDEEP

    24576:j6keeZ0ul2SbasyzqB/8eT4wUB+lVSgln6R3nbNAHfHTr/A4X84BtY1Qli7rAIuq:zZdwSOsyzqBL1UMnl6R3+33d07rh

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e087f4ac3f9ccb36c669bc50b280f2c3964057b209c5a92199f42663ba614fe5.exe
    "C:\Users\Admin\AppData\Local\Temp\e087f4ac3f9ccb36c669bc50b280f2c3964057b209c5a92199f42663ba614fe5.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Checks whether UAC is enabled
    PID:2028

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2028-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

    Filesize

    8KB

  • memory/2028-55-0x0000000000400000-0x0000000000872000-memory.dmp

    Filesize

    4.4MB

  • memory/2028-56-0x0000000000400000-0x0000000000872000-memory.dmp

    Filesize

    4.4MB