Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2023 04:18
General
-
Target
frAQBc8W.exe
-
Size
4.4MB
-
MD5
c5e25683bad6530516b83b00c6332788
-
SHA1
4cb7f56d9332b8d3dd2bbe65b231f27d52598620
-
SHA256
f065d31c557335cad992a806aad8adb893ee2b35de8ab3b206290006991f354f
-
SHA512
440c4191797704bae1609092631dd5dfdefd71c84281facd921cd6b19cbc1e52c781b2c0864d08871558e9788cdec0b38bcd1d701aa0432a9360e52eff775646
-
SSDEEP
98304:aUTa4GtDOPFiDyqc1RxZ3mYmZix9nSz8cQGDtE6pQacW8KPOXxK:H2DOPFiDyqc1UiS8mLpaoOXxK
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
frAQBc8W.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ frAQBc8W.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
frAQBc8W.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions frAQBc8W.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
frAQBc8W.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion frAQBc8W.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion frAQBc8W.exe -
Processes:
resource yara_rule behavioral1/memory/4028-133-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-134-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-135-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-136-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-137-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-171-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-227-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-279-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-332-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-383-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-442-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-496-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-558-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-616-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-684-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-750-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-810-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-876-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida behavioral1/memory/4028-936-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmp themida -
Processes:
frAQBc8W.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA frAQBc8W.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
frAQBc8W.exepid process 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
frAQBc8W.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN frAQBc8W.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
frAQBc8W.exepid process 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe 4028 frAQBc8W.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
frAQBc8W.execmd.exedescription pid process target process PID 4028 wrote to memory of 548 4028 frAQBc8W.exe cmd.exe PID 4028 wrote to memory of 548 4028 frAQBc8W.exe cmd.exe PID 4028 wrote to memory of 1660 4028 frAQBc8W.exe cmd.exe PID 4028 wrote to memory of 1660 4028 frAQBc8W.exe cmd.exe PID 4028 wrote to memory of 4812 4028 frAQBc8W.exe cmd.exe PID 4028 wrote to memory of 4812 4028 frAQBc8W.exe cmd.exe PID 4028 wrote to memory of 3148 4028 frAQBc8W.exe cmd.exe PID 4028 wrote to memory of 3148 4028 frAQBc8W.exe cmd.exe PID 3148 wrote to memory of 416 3148 cmd.exe certutil.exe PID 3148 wrote to memory of 416 3148 cmd.exe certutil.exe PID 3148 wrote to memory of 3900 3148 cmd.exe find.exe PID 3148 wrote to memory of 3900 3148 cmd.exe find.exe PID 3148 wrote to memory of 4904 3148 cmd.exe find.exe PID 3148 wrote to memory of 4904 3148 cmd.exe find.exe PID 4028 wrote to memory of 4460 4028 frAQBc8W.exe cmd.exe PID 4028 wrote to memory of 4460 4028 frAQBc8W.exe cmd.exe PID 4028 wrote to memory of 4568 4028 frAQBc8W.exe cmd.exe PID 4028 wrote to memory of 4568 4028 frAQBc8W.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\frAQBc8W.exe"C:\Users\Admin\AppData\Local\Temp\frAQBc8W.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 22⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 52⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c CLS2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\frAQBc8W.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\frAQBc8W.exe" MD53⤵
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c CLS2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 52⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4028-133-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-134-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-135-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-136-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-137-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-171-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-227-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-279-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-332-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-383-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-442-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-496-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-558-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-616-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-684-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-750-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-810-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-876-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB
-
memory/4028-936-0x00007FF6C7F40000-0x00007FF6C8B05000-memory.dmpFilesize
11.8MB