Analysis
-
max time kernel
338s -
max time network
404s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
04/12/2022, 09:22
General
-
Target
ID_EBTXV-Ar_ES6a1Sj0.exe
-
Size
13.6MB
-
MD5
c2ae27b92b481f1abdd24640679ad884
-
SHA1
88385e8e1ac88dff263e1edb86e187569be6c0b4
-
SHA256
62697eded6b42b898ab217eb486c7a9ab0f9a46deeafe4cd7536b13774977b11
-
SHA512
6394d18ef125497b5a73d90bc2ce81e3f7d4ba9a8f8562e24f68e9728e8ff0e95c8e8e16dff9d8a426e1a69c9592746923a9626efd2d0bca8f8cf8633a3d91a4
-
SSDEEP
393216:Fp1La6D1s11U11MlF911U11UhoI11U11osLoT4ACZEMwwWDD:gELPmjD
Score
9/10
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ID_EBTXV-Ar_ES6a1Sj0.exe"C:\Users\Admin\AppData\Local\Temp\ID_EBTXV-Ar_ES6a1Sj0.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 472 -p 3628 -ip 36281⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3628 -s 24601⤵
- Program crash
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
10.8MB