4ad4b1410ed957d39985d24c613036f2b777dd2ed01a3ae7a9ab28e298f29ede

Resubmissions

09-02-2023 09:04

230209-k1zyqsdc3w 9

09-02-2023 08:58

230209-kxfexsda4t 9

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2023 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00gif.dll
Size

171KB
MD5

60827386e2d158fb3c2dff6ef19a6a3e
SHA1

7f687e70c319d419b91c85b4c8a027cae2876714
SHA256

4ad4b1410ed957d39985d24c613036f2b777dd2ed01a3ae7a9ab28e298f29ede
SHA512

a1a612af39d410ad6c5d17b016d8c0c9b4436203cc57616b436b18e40b715a4e80ab9b5419b4229b92a2a70e755a8eb41c8bda424fa503dc06ba5951f50a0bcc
SSDEEP

3072:8uZ6hcvJTZ9oVFBfnIyht8vPs1XQHBC92ePuH:dTN4HBnI2t8vPLu6

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	regsvr32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1664	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4776	PING.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2740	2376	regsvr32.exe	79
PID 2376 wrote to memory of 2740	2376	regsvr32.exe	79
PID 2376 wrote to memory of 2740	2376	regsvr32.exe	79
PID 2740 wrote to memory of 1664	2740	regsvr32.exe	80
PID 2740 wrote to memory of 1664	2740	regsvr32.exe	80
PID 2740 wrote to memory of 1664	2740	regsvr32.exe	80
PID 2740 wrote to memory of 5088	2740	regsvr32.exe	82
PID 2740 wrote to memory of 5088	2740	regsvr32.exe	82
PID 2740 wrote to memory of 5088	2740	regsvr32.exe	82
PID 5088 wrote to memory of 4776	5088	cmd.exe	84
PID 5088 wrote to memory of 4776	5088	cmd.exe	84
PID 5088 wrote to memory of 4776	5088	cmd.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\00gif.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\00gif.dll
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /F /TN "{8B30B3CD-2068-4F75-AB1F-FCAE6AF928B6}" /TR " cmd /q /c start /min \"\" powershell \"$nonresistantOutlivesDictatorial = Get-ItemProperty -Path HKCU:\Software\nonresistantOutlivesDictatorial; powershell -encodedcommand $nonresistantOutlivesDictatorial.AphroniaHaimavati \"" /SC MINUTE /MO 13
    3⤵
    - Creates scheduled task(s)
    PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C "ping localhost && DEL /F /S /Q /A C:\Users\Admin\AppData\Local\Temp\00gif.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost
      4⤵
      Runs ping.exe
      PID:4776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-134-0x0000000001270000-0x0000000001275000-memory.dmp

Filesize
20KB

Download
memory/2740-135-0x0000000001280000-0x0000000001287000-memory.dmp

Filesize
28KB

Download
memory/2740-137-0x0000000001280000-0x0000000001287000-memory.dmp

Filesize
28KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads