08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1

Analysis

max time kernel
105s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe
Size

3.5MB
MD5

254dcf23c7850a156e31e8a4f63f6665
SHA1

a67018ebe42793bead68749d7035934341b6515c
SHA256

08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1
SHA512

a0143a733f494e66cd5432a07c44bafc18abd26226107b038d6932cf0434b9897a6599569ef6aa21c294690d2177bbe0ec4fb0daf6c05a452dddd8632df99690
SSDEEP

98304:iP87eh6bRyDuA54GMD6DPArJ5qgUrCxOTtOe:k84CIU64rJ5qgqCxOTth

Score

9^/10

evasion persistence

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Wine	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Local\Temp\08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe"	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1608	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1608	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe
1608	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1608	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1608	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe
1608	08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe

C:\Users\Admin\AppData\Local\Temp\08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe
"C:\Users\Admin\AppData\Local\Temp\08b28675a2b2790d434ea780730bfefb956ceb7794ccc1c584635b18a83fc0e1.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1608-132-0x0000000000400000-0x00000000009CA000-memory.dmp

Filesize
5.8MB

Download
memory/1608-133-0x0000000077BC0000-0x0000000077D63000-memory.dmp

Filesize
1.6MB

Download
memory/1608-134-0x0000000000400000-0x00000000009CA000-memory.dmp

Filesize
5.8MB

Download
memory/1608-135-0x0000000000400000-0x00000000009CA000-memory.dmp

Filesize
5.8MB

Download
memory/1608-136-0x0000000077BC0000-0x0000000077D63000-memory.dmp

Filesize
1.6MB

Download
memory/1608-137-0x0000000000400000-0x00000000009CA000-memory.dmp

Filesize
5.8MB

Download