Overview

overview

9

Static

static

1a66ecaa37...b2.exe

windows7-x64

9

1a66ecaa37...b2.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    43s
  • max time network
    108s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 12:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1a66ecaa37a735c1d1fe43612623bc26f99f191c19cb7bac793fe1404274c0b2.exe

  • Size

    1.7MB

  • MD5

    18e53aa829155db8e698f53e142cd4f4

  • SHA1

    12123449252992b6228968d7fca518e5f2c767dd

  • SHA256

    1a66ecaa37a735c1d1fe43612623bc26f99f191c19cb7bac793fe1404274c0b2

  • SHA512

    4ce72f7b3bb1bed62c7ad4dd6ff51fbd702ef38d86b159351e6ddf7874a4cf57f54c9a223df1e3bf1a4780a07850da8f6f073bfb6a5b0172eb6b62b541736770

  • SSDEEP

    24576:3nxpEKzHXmW1+9VRMSTn9mqvED6FuYLfADPSVaZ28ycZ9/hLw7i:3nxCcGvRb9mL686ADPSV62m1Zw7

Score
9/10
evasion

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 42 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a66ecaa37a735c1d1fe43612623bc26f99f191c19cb7bac793fe1404274c0b2.exe
    "C:\Users\Admin\AppData\Local\Temp\1a66ecaa37a735c1d1fe43612623bc26f99f191c19cb7bac793fe1404274c0b2.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:620

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/620-54-0x0000000000400000-0x00000000007F5000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/620-55-0x0000000075711000-0x0000000075713000-memory.dmp

    Filesize

    8KB

    Download

  • memory/620-56-0x0000000077C90000-0x0000000077E10000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/620-57-0x0000000000400000-0x00000000007F5000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/620-58-0x0000000000400000-0x00000000007F5000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/620-59-0x0000000077C90000-0x0000000077E10000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/620-60-0x0000000000400000-0x00000000007F5000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/620-61-0x0000000000400000-0x00000000007F5000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/620-62-0x0000000077C90000-0x0000000077E10000-memory.dmp

    Filesize

    1.5MB

    Download