a3ce4b4b8f6173d1fab0672bad02cd657add4e1d74bae82869883a96e99b3e77

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2023, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48347d71215b181d90ec570f405f98b0.exe
Size 3.4MB
Sample230317-vb9rrahb73
SHA256 a3ce4b4b8f6173d1fab0672bad02cd657add4e1d74bae82869883a96e99b3e77
MD5 48347d71215b181d90ec570f405f98b0
SHA1 83ab33b39f40a7e64cbd26c18d5602a4ce00facc
SHA512 f4703e69eb97665974f469c7ff1f4dfcee3534b84cffcc0fb43e015a7a27a6b959d03fc637c43825f2be559d1c3aa9dbde6d0e515d2769d16d1535a433ede156
SSDEEP 98304:AoaD2xzt49ndR/hqOAX7Jhh15VRN6UnNOzFv:Vt4rqN19n2
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery evasion trojan upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WindowsHolographicDevicesssh-type7.0.7.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WindowsHolographicDevicesssh-type7.0.7.6.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WindowsHolographicDevicesssh-type7.0.7.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WindowsHolographicDevicesssh-type7.0.7.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WindowsHolographicDevicesssh-type7.0.7.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WindowsHolographicDevicesssh-type7.0.7.6.exe

Executes dropped EXE 2 IoCs

pid	Process
2328	WindowsHolographicDevicesssh-type7.0.7.6.exe
1696	WindowsHolographicDevicesssh-type7.0.7.6.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4968	icacls.exe
4784	icacls.exe
4484	icacls.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000230f7-149.dat	upx
behavioral2/files/0x00010000000230f7-150.dat	upx
behavioral2/files/0x00010000000230f7-151.dat	upx
behavioral2/memory/2328-152-0x00007FF733F30000-0x00007FF73444F000-memory.dmp	upx
behavioral2/memory/2328-154-0x00007FF733F30000-0x00007FF73444F000-memory.dmp	upx
behavioral2/memory/2328-155-0x00007FF733F30000-0x00007FF73444F000-memory.dmp	upx
behavioral2/memory/2328-156-0x00007FF733F30000-0x00007FF73444F000-memory.dmp	upx
behavioral2/files/0x00010000000230f7-157.dat	upx
behavioral2/memory/1696-158-0x00007FF733F30000-0x00007FF73444F000-memory.dmp	upx
behavioral2/memory/1696-159-0x00007FF733F30000-0x00007FF73444F000-memory.dmp	upx
behavioral2/memory/1696-160-0x00007FF733F30000-0x00007FF73444F000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WindowsHolographicDevicesssh-type7.0.7.6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WindowsHolographicDevicesssh-type7.0.7.6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 3304	2100	48347d71215b181d90ec570f405f98b0.exe	88

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1972	schtasks.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 3304	2100	48347d71215b181d90ec570f405f98b0.exe	88
PID 2100 wrote to memory of 3304	2100	48347d71215b181d90ec570f405f98b0.exe	88
PID 2100 wrote to memory of 3304	2100	48347d71215b181d90ec570f405f98b0.exe	88
PID 2100 wrote to memory of 3304	2100	48347d71215b181d90ec570f405f98b0.exe	88
PID 2100 wrote to memory of 3304	2100	48347d71215b181d90ec570f405f98b0.exe	88
PID 3304 wrote to memory of 4968	3304	AppLaunch.exe	96
PID 3304 wrote to memory of 4968	3304	AppLaunch.exe	96
PID 3304 wrote to memory of 4968	3304	AppLaunch.exe	96
PID 3304 wrote to memory of 4784	3304	AppLaunch.exe	98
PID 3304 wrote to memory of 4784	3304	AppLaunch.exe	98
PID 3304 wrote to memory of 4784	3304	AppLaunch.exe	98
PID 3304 wrote to memory of 4484	3304	AppLaunch.exe	100
PID 3304 wrote to memory of 4484	3304	AppLaunch.exe	100
PID 3304 wrote to memory of 4484	3304	AppLaunch.exe	100
PID 3304 wrote to memory of 1972	3304	AppLaunch.exe	102
PID 3304 wrote to memory of 1972	3304	AppLaunch.exe	102
PID 3304 wrote to memory of 1972	3304	AppLaunch.exe	102
PID 3304 wrote to memory of 2328	3304	AppLaunch.exe	103
PID 3304 wrote to memory of 2328	3304	AppLaunch.exe	103

C:\Users\Admin\AppData\Local\Temp\48347d71215b181d90ec570f405f98b0.exe
"C:\Users\Admin\AppData\Local\Temp\48347d71215b181d90ec570f405f98b0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
    3⤵
    - Modifies file permissions
    PID:4968
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
    3⤵
    - Modifies file permissions
    PID:4784
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6" /inheritance:e /deny "admin:(R,REA,RA,RD)"
    3⤵
    - Modifies file permissions
    PID:4484
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /TN "WindowsHolographicDevicesssh-type7.0.7.6\WindowsHolographicDevicesssh-type7.0.7.6" /TR "C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6\WindowsHolographicDevicesssh-type7.0.7.6.exe" /SC MINUTE
    3⤵
    - Creates scheduled task(s)
    PID:1972
- - C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6\WindowsHolographicDevicesssh-type7.0.7.6.exe
    "C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6\WindowsHolographicDevicesssh-type7.0.7.6.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    PID:2328

C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6\WindowsHolographicDevicesssh-type7.0.7.6.exe
C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6\WindowsHolographicDevicesssh-type7.0.7.6.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WindowsHolographicDevicesssh-type7.0.7.6.exe

Path C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6\WindowsHolographicDevicesssh-type7.0.7.6.exe
Size 418.1MB
SHA256 cfea8f6abf5660c0b5e954c33bf15b4c09cce5cf13f917e566f19fd9e1904c93
MD5 ebe459fcbcbc5743955686d1218da786
SHA1 fdbfbdcd52a2167f9f24feb73a30b6e1171e1e43
SHA512 e3264a1d21a7ed1c69c6536cd3fed1ca52dd023b0f831f7323c8d70a887b33815d6525a6ecf7f6836d30124a92b7e6b825720e3afb773245600f8e96961c6f67
SSDEEP 12582912:ePlrsDt2KDBOb/EtnHOCUCXfvFgfMRBr5:sY0KDBQ/EtHOCNgfKz
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsHolographicDevicesssh-type7.0.7.6.exe

Path C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6\WindowsHolographicDevicesssh-type7.0.7.6.exe
Size 420.1MB
SHA256 f0150bab4181666bd386a247befb623a672e0c664f3fb2e37b43b7e730ec6c61
MD5 bb39689ca7e091e8225c3049452ecee7
SHA1 4fb75dea586175fd30b8a3c56d353c71efd3b44d
SHA512 cfaff60de2dc0ca2afaa3cdefb8af97d36ffae8eb11691a8a324c953c535e5d543f3c33bcba3b0f8972bf5feec5d9a79f2544366f8147e362d394942a314d96f
SSDEEP 12582912:ePlrsDt2KDBOb/EtnHOCUCXfvFgfMRBr1:sY0KDBQ/EtHOCNgfKn
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsHolographicDevicesssh-type7.0.7.6.exe

Path C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6\WindowsHolographicDevicesssh-type7.0.7.6.exe
Size 299.2MB
SHA256 ec60828f653c9f34c72fb43ace13714d9bf05e4c69bdbde6e6e253793105fd5b
MD5 e0984b925d1b3376424f10b1325ffc47
SHA1 93066265d3d66a8d6fad813e88d9df3ac162ff1e
SHA512 39235694172e1f15ce2e6c1ffde9a7e92ed43071aa854c376f5859576a3c0ae637e6a04158a281108417056f7276b4f0578d584f0c412401ad9b68845f5eaba2
SSDEEP 6291456:5AJPUEQQiwse6G9e8XuCuDyUhwbaGc/tSky8BUecrCU9MaMfb:ePlrsDt2KDBOb/EtnHOCUCXfb
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsHolographicDevicesssh-type7.0.7.6.exe

Path C:\ProgramData\WindowsHolographicDevicesssh-type7.0.7.6\WindowsHolographicDevicesssh-type7.0.7.6.exe
Size 325.1MB
SHA256 84e04c9b591023dfd5432cfdea2f0e83f72a554910db7e5e6f31198e53f65a93
MD5 04dfed1719b5573a8523ea8a6255bdcd
SHA1 eb7644cf3053d1b259fb0270780ff0deeeb37b38
SHA512 2b690c2d9b6ae2d4bf817a71e75cc8961d518e5939bb30281ba61826a2d64925e6448dbe17ee73337f9fc8b29451a9838da6b764246984f9f78750177a7ed65e
SSDEEP 6291456:5AJPUEQQiwse6G9e8XuCuDyUhwbaGc/tSky8BUecrCU9MaMfJrudcFu:ePlrsDt2KDBOb/EtnHOCUCXfvFu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1696-160-0x00007FF733F30000-0x00007FF73444F000-memory.dmp

Download

memory/1696-159-0x00007FF733F30000-0x00007FF73444F000-memory.dmp

Download

memory/1696-158-0x00007FF733F30000-0x00007FF73444F000-memory.dmp

Download

memory/2328-154-0x00007FF733F30000-0x00007FF73444F000-memory.dmp

Download

memory/2328-152-0x00007FF733F30000-0x00007FF73444F000-memory.dmp

Download

memory/2328-155-0x00007FF733F30000-0x00007FF73444F000-memory.dmp

Download

memory/2328-156-0x00007FF733F30000-0x00007FF73444F000-memory.dmp

Download

memory/3304-144-0x0000000005770000-0x0000000005780000-memory.dmp

Download

memory/3304-143-0x0000000005770000-0x0000000005780000-memory.dmp

Download

memory/3304-142-0x0000000005770000-0x0000000005780000-memory.dmp

Download

memory/3304-133-0x0000000000400000-0x000000000075C000-memory.dmp

Download

memory/3304-141-0x00000000056D0000-0x00000000056DA000-memory.dmp

Download

memory/3304-140-0x0000000005770000-0x0000000005780000-memory.dmp

Download

memory/3304-139-0x0000000005610000-0x00000000056A2000-memory.dmp

Download

memory/3304-138-0x0000000005B20000-0x00000000060C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads