Analysis
-
max time kernel
60s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2023 00:34
Static task
static1
Behavioral task
behavioral1
Sample
4213ds/u3yUAGt07i.exe
Resource
win7-20220812-en
General
-
Target
4213ds/u3yUAGt07i.exe
-
Size
12.9MB
-
MD5
7791d25acbf4b6e03392aad4cbaf93a0
-
SHA1
afd50ed24e2dcb8ffd128c22e8e526870e065a04
-
SHA256
8e46242657a4a84d31840341fb023d4c08b053e0f4329e3d837b1cb5d22e1708
-
SHA512
72479d19d91e7410dc80d77314243f2b087ff02abd2224bd28112e79eb75e94c31d1f0382ceefe1be911be392e171f0b59b303b8eb76aefb4eadfb769a5c206c
-
SSDEEP
196608:/ntHA/J/KgW9znu4MUwN0OdER9P9zjBgOiPp97rMAfZ+WL9kdAe9XWc:/tSJCZ9znMJN0OdUnHBgZHr54WLedAWN
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
u3yUAGt07i.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ u3yUAGt07i.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
u3yUAGt07i.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion u3yUAGt07i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion u3yUAGt07i.exe -
Processes:
u3yUAGt07i.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA u3yUAGt07i.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
u3yUAGt07i.exepid process 4864 u3yUAGt07i.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
u3yUAGt07i.exepid process 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
u3yUAGt07i.exepid process 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe 4864 u3yUAGt07i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4213ds\u3yUAGt07i.exe"C:\Users\Admin\AppData\Local\Temp\4213ds\u3yUAGt07i.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4864-132-0x00000000004B0000-0x000000000230B000-memory.dmpFilesize
30.4MB
-
memory/4864-134-0x0000000077A50000-0x0000000077BF3000-memory.dmpFilesize
1.6MB
-
memory/4864-133-0x00000000004B0000-0x000000000230B000-memory.dmpFilesize
30.4MB
-
memory/4864-135-0x00000000004B0000-0x000000000230B000-memory.dmpFilesize
30.4MB
-
memory/4864-136-0x00000000004B0000-0x000000000230B000-memory.dmpFilesize
30.4MB
-
memory/4864-137-0x00000000004B0000-0x000000000230B000-memory.dmpFilesize
30.4MB
-
memory/4864-138-0x00000000004B0000-0x000000000230B000-memory.dmpFilesize
30.4MB
-
memory/4864-139-0x00000000004B0000-0x000000000230B000-memory.dmpFilesize
30.4MB
-
memory/4864-140-0x00000000004B0000-0x000000000230B000-memory.dmpFilesize
30.4MB
-
memory/4864-141-0x0000000077A50000-0x0000000077BF3000-memory.dmpFilesize
1.6MB
-
memory/4864-142-0x00000000004B0000-0x000000000230B000-memory.dmpFilesize
30.4MB