bd0488bd8c388dd8f1055b7429a0b406d29a8d0f6c44e710c8887b48e1828b65

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd0488bd8c388dd8f1055b7429a0b406d29a8d0f6c44e710c8887b48e1828b65.dll
Size

727KB
MD5

0e6e52ae9d922ec2377740e2d9d7f72e
SHA1

d5dca59868769dd61510af646e41aa830536096a
SHA256

bd0488bd8c388dd8f1055b7429a0b406d29a8d0f6c44e710c8887b48e1828b65
SHA512

1eb2805b0a7c4d5c7889026bd21523c562c4b50f24ff1f45fc41255cda8416ca2d67f4125e5a541034c0a8fd413ad82f9c2e27054ea3d657a7d9308f72ed0253
SSDEEP

12288:QoqZ0FV03nIjupZm3B21tiWWx0OSa5/4b8EO0y8YMoqxyuuOglaBVuMZ2Ze05k:UIjMEI1tiVSOl5/4gEYjqzIaBsM0

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	regsvr32.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Wine	regsvr32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1880	regsvr32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
964	1880	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1880	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1880	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1880	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1880	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1880	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1880	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1880	1824	regsvr32.exe	27
PID 1824 wrote to memory of 1880	1824	regsvr32.exe	27
PID 1880 wrote to memory of 964	1880	regsvr32.exe	28
PID 1880 wrote to memory of 964	1880	regsvr32.exe	28
PID 1880 wrote to memory of 964	1880	regsvr32.exe	28
PID 1880 wrote to memory of 964	1880	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\bd0488bd8c388dd8f1055b7429a0b406d29a8d0f6c44e710c8887b48e1828b65.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\bd0488bd8c388dd8f1055b7429a0b406d29a8d0f6c44e710c8887b48e1828b65.dll
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 480
    3⤵
    - Program crash
    PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-54-0x000007FEFB5C1000-0x000007FEFB5C3000-memory.dmp

Filesize
8KB

Download
memory/1880-56-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1880-57-0x00000000020C0000-0x000000000225E000-memory.dmp

Filesize
1.6MB

Download
memory/1880-59-0x00000000020C0000-0x000000000225E000-memory.dmp

Filesize
1.6MB

Download
memory/1880-60-0x0000000076F20000-0x00000000770A0000-memory.dmp

Filesize
1.5MB

Download