Analysis
-
max time kernel
151s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
09-12-2022 15:30
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.27511.29896.exe
-
Size
1.0MB
-
MD5
9061ed6b5d2456e0ecb5aac7091f5e88
-
SHA1
3ec6e4697aabe693287ece278c9b71d070a136b1
-
SHA256
26cd2bcced6805a4bcfb2f0f36ee11314431ae022d0a38ec91f0108a6625dd07
-
SHA512
43c809767403916ceb919ae560696110f30623441d0d44bb4cc0ad68d5c318e196e6fbb2ca3971e0cd624e2b55f77c3da5612544a6e9712eafa73f8341abc323
-
SSDEEP
12288:lANfRvL4JCjVJisvqVW6iD12AsTaE955VVhIbHMaVCTsEilXAbZBpFLu9LeUhdL:qNf1LWChEW6K2Ae7V8HMc7XAfpFc
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.27511.29896.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.27511.29896.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hbHEdSCoK.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hbHEdSCoK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp994D.tmp"2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55c4968698b0196a1156a0ef91188e236
SHA1bdf45dd5b8b734d5bd27ed2b0538e79041053d6a
SHA2560610077a7694c669c90c0c227c63473971b0f9c814834db3dfc1913cadc23ce8
SHA51238eed216f2453df6c0813f87a2062279ac7b2dc5b83578cbc3e5675874a711ae22dbba55ed05ebf1dc162dc646209afd6a140019ff6d561ce6c1c1f4db2f6754
-
-
Filesize
216KB
-
Filesize
1.1MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
408KB
-