4ad4b1410ed957d39985d24c613036f2b777dd2ed01a3ae7a9ab28e298f29ede

Resubmissions

09/02/2023, 09:04

230209-k1zyqsdc3w 9

09/02/2023, 08:58

230209-kxfexsda4t 9

Analysis

max time kernel
179s
max time network
236s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
09/02/2023, 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00gif.dll
Size

171KB
MD5

60827386e2d158fb3c2dff6ef19a6a3e
SHA1

7f687e70c319d419b91c85b4c8a027cae2876714
SHA256

4ad4b1410ed957d39985d24c613036f2b777dd2ed01a3ae7a9ab28e298f29ede
SHA512

a1a612af39d410ad6c5d17b016d8c0c9b4436203cc57616b436b18e40b715a4e80ab9b5419b4229b92a2a70e755a8eb41c8bda424fa503dc06ba5951f50a0bcc
SSDEEP

3072:8uZ6hcvJTZ9oVFBfnIyht8vPs1XQHBC92ePuH:dTN4HBnI2t8vPLu6

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3876	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3060	PING.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4948	4868	regsvr32.exe	78
PID 4868 wrote to memory of 4948	4868	regsvr32.exe	78
PID 4868 wrote to memory of 4948	4868	regsvr32.exe	78
PID 4948 wrote to memory of 3876	4948	regsvr32.exe	80
PID 4948 wrote to memory of 3876	4948	regsvr32.exe	80
PID 4948 wrote to memory of 3876	4948	regsvr32.exe	80
PID 4948 wrote to memory of 2148	4948	regsvr32.exe	83
PID 4948 wrote to memory of 2148	4948	regsvr32.exe	83
PID 4948 wrote to memory of 2148	4948	regsvr32.exe	83
PID 2148 wrote to memory of 3060	2148	cmd.exe	85
PID 2148 wrote to memory of 3060	2148	cmd.exe	85
PID 2148 wrote to memory of 3060	2148	cmd.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\00gif.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\00gif.dll
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /F /TN "{8B30B3CD-2068-4F75-AB1F-FCAE6AF928B6}" /TR " cmd /q /c start /min \"\" powershell \"$nonresistantOutlivesDictatorial = Get-ItemProperty -Path HKCU:\Software\nonresistantOutlivesDictatorial; powershell -encodedcommand $nonresistantOutlivesDictatorial.AphroniaHaimavati \"" /SC MINUTE /MO 13
    3⤵
    - Creates scheduled task(s)
    PID:3876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C "ping localhost && DEL /F /S /Q /A "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:3060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4948-133-0x0000000000A40000-0x0000000000A45000-memory.dmp

Filesize
20KB

Download
memory/4948-134-0x0000000000A50000-0x0000000000A57000-memory.dmp

Filesize
28KB

Download
memory/4948-137-0x0000000000A50000-0x0000000000A57000-memory.dmp

Filesize
28KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads