Analysis
-
max time kernel
21s -
max time network
24s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 20:58
Behavioral task
behavioral1
Sample
V4.exe
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
General
-
Target
V4.exe
-
Size
11.4MB
-
MD5
2d0cb9ec97e5abac40a692aab91689c4
-
SHA1
82b37f06255d3c8ec5e088fe5cf7f58fdf27b601
-
SHA256
29a29d55f032057c27090196e48c2cad52bd5bc46642513a344879b95a81f5d6
-
SHA512
33448e712588550d5e77535be52e2e653cd67ffa3e928182d8af68530db3e06960614e7bafcb4c5c66776f72e79954776641406b2e7f0d4946ee7794aceb5d3c
-
SSDEEP
196608:76u3qVKcZ40PqqTOtfsLabW1RoNOL4CRRPG8uVfYW47ZIcZYM2mFIoNqcqT/Cg:76u6C0PqQOtEmbWbhRPG8uVwW4ecZxmD
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
V4.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ V4.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
V4.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion V4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion V4.exe -
Processes:
resource yara_rule behavioral2/memory/448-133-0x00007FF754660000-0x00007FF755DD0000-memory.dmp themida behavioral2/memory/448-134-0x00007FF754660000-0x00007FF755DD0000-memory.dmp themida behavioral2/memory/448-135-0x00007FF754660000-0x00007FF755DD0000-memory.dmp themida behavioral2/memory/448-136-0x00007FF754660000-0x00007FF755DD0000-memory.dmp themida behavioral2/memory/448-137-0x00007FF754660000-0x00007FF755DD0000-memory.dmp themida behavioral2/memory/448-138-0x00007FF754660000-0x00007FF755DD0000-memory.dmp themida behavioral2/memory/448-139-0x00007FF754660000-0x00007FF755DD0000-memory.dmp themida behavioral2/memory/448-140-0x00007FF754660000-0x00007FF755DD0000-memory.dmp themida behavioral2/memory/448-141-0x00007FF754660000-0x00007FF755DD0000-memory.dmp themida behavioral2/memory/448-142-0x00007FF754660000-0x00007FF755DD0000-memory.dmp themida -
Processes:
V4.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA V4.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
V4.exepid process 448 V4.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 228 448 WerFault.exe V4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
V4.exedescription pid process Token: SeDebugPrivilege 448 V4.exe Token: SeDebugPrivilege 448 V4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\V4.exe"C:\Users\Admin\AppData\Local\Temp\V4.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 448 -s 6042⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 448 -ip 4481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/448-133-0x00007FF754660000-0x00007FF755DD0000-memory.dmpFilesize
23.4MB
-
memory/448-134-0x00007FF754660000-0x00007FF755DD0000-memory.dmpFilesize
23.4MB
-
memory/448-135-0x00007FF754660000-0x00007FF755DD0000-memory.dmpFilesize
23.4MB
-
memory/448-136-0x00007FF754660000-0x00007FF755DD0000-memory.dmpFilesize
23.4MB
-
memory/448-137-0x00007FF754660000-0x00007FF755DD0000-memory.dmpFilesize
23.4MB
-
memory/448-138-0x00007FF754660000-0x00007FF755DD0000-memory.dmpFilesize
23.4MB
-
memory/448-139-0x00007FF754660000-0x00007FF755DD0000-memory.dmpFilesize
23.4MB
-
memory/448-140-0x00007FF754660000-0x00007FF755DD0000-memory.dmpFilesize
23.4MB
-
memory/448-141-0x00007FF754660000-0x00007FF755DD0000-memory.dmpFilesize
23.4MB
-
memory/448-142-0x00007FF754660000-0x00007FF755DD0000-memory.dmpFilesize
23.4MB