Analysis
-
max time kernel
72s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
03-03-2023 15:33
Static task
static1
Behavioral task
behavioral1
Sample
windows.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
windows.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
winvetxvdf33
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
winvetxvdf33
Resource
win10v2004-20230220-en
General
-
Target
windows.exe
-
Size
5.3MB
-
MD5
6fd40c6b89a1719188980d7550fc37fc
-
SHA1
7e40eaca74b67de2d0cec3046ff25a9102b88560
-
SHA256
fa967cdd39a4a0bbb104c1723966c81f6c58e3dba6f8ff3371143512b5ce35ea
-
SHA512
99ebfb328b117041d4feaebe80fa7b4dbeb280daa4e51bd59aef73dce683ab4b292b44c3410b59bec42c5f4e676bb9eb822bd1469a2fdcc8929b8fb9af80fc12
-
SSDEEP
98304:U/wN6vaQpuq4Tj0TgTQ4M+7LWVNtVPOK2Q3JAH24O6V6DsFR708u:C+VpsTn4h3AYOg2J6Io0l
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
windows.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ windows.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
windows.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion windows.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion windows.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
windows.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run windows.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\qfqztdim = "C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe" windows.exe -
Processes:
windows.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA windows.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
windows.exepid process 1156 windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 1 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
windows.exepid process 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe 1156 windows.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
windows.exepid process 1156 windows.exe 1156 windows.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1156-54-0x00000000003B0000-0x00000000014C0000-memory.dmpFilesize
17.1MB
-
memory/1156-55-0x00000000003B0000-0x00000000014C0000-memory.dmpFilesize
17.1MB
-
memory/1156-56-0x00000000003B0000-0x00000000014C0000-memory.dmpFilesize
17.1MB
-
memory/1156-57-0x00000000003B0000-0x00000000014C0000-memory.dmpFilesize
17.1MB
-
memory/1156-58-0x00000000003B0000-0x00000000014C0000-memory.dmpFilesize
17.1MB
-
memory/1156-59-0x00000000003B0000-0x00000000014C0000-memory.dmpFilesize
17.1MB
-
memory/1156-60-0x00000000003B0000-0x00000000014C0000-memory.dmpFilesize
17.1MB
-
memory/1156-61-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/1156-62-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1156-63-0x00000000003B0000-0x00000000014C0000-memory.dmpFilesize
17.1MB
-
memory/1156-64-0x0000000009F20000-0x000000000F897000-memory.dmpFilesize
89.5MB
-
memory/1156-65-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1156-69-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1156-71-0x00000000003B0000-0x00000000014C0000-memory.dmpFilesize
17.1MB