Analysis

  • max time kernel
    147s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    22-03-2023 01:51

General

  • Target

    449adac1f0940043f26ab1a8b91748360b4d7d9759108d3db6669edd758129cb.exe

  • Size

    5.6MB

  • MD5

    c5d71dbbbc50db8c2762835e83e0bd9c

  • SHA1

    e266d9870fcf13d7072e9e7a6a881a239ac0c523

  • SHA256

    449adac1f0940043f26ab1a8b91748360b4d7d9759108d3db6669edd758129cb

  • SHA512

    4ff07f801849131e621f7fa605c4215f3bd1c4229e1de99b23f3fc7c07c0a798935cb590fa9ea0b9fee1422f771198bbb84a58ad128743e7e90580fb29304bdc

  • SSDEEP

    98304:H7nk+M3jECnNQJkMn33Mbz0Hy5SF+EaIFKedyFY1+EgYO6wLujDo8E+7LtJqfjXC:YLzhMCpQ+1edyePg969JTEX6NZ

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\449adac1f0940043f26ab1a8b91748360b4d7d9759108d3db6669edd758129cb.exe
    "C:\Users\Admin\AppData\Local\Temp\449adac1f0940043f26ab1a8b91748360b4d7d9759108d3db6669edd758129cb.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\ProgramData\MicrosoftTemplates-tupe9.5.3.2\MicrosoftTemplates-tupe9.5.3.2.exe
      "C:\ProgramData\MicrosoftTemplates-tupe9.5.3.2\MicrosoftTemplates-tupe9.5.3.2.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      PID:920

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\MicrosoftTemplates-tupe9.5.3.2\MicrosoftTemplates-tupe9.5.3.2.exe
    Filesize

    473.6MB

    MD5

    91b2f9c71b25f3b42769ce4d6dc6ec01

    SHA1

    2723dd68d1dcd6e1be546e876d8ef5209bf4807b

    SHA256

    f6639d6920d0230ac001d08a6e1abcd4c2ed5615df3de9676fd2f2e7294314ff

    SHA512

    bdabddfa3177a5189f18066c70d14e2dd9363443b01ab7616359a9c12fe3f04c918cc3791b905d2348a3b30307796f59222518a237adc1685f5c5e55d05e048c

  • C:\ProgramData\MicrosoftTemplates-tupe9.5.3.2\MicrosoftTemplates-tupe9.5.3.2.exe
    Filesize

    512.5MB

    MD5

    39d140ba665d73a6b337e1c69599db98

    SHA1

    411a3163d7e0bb4b51a9ed135e8bdbbb1763257b

    SHA256

    0a80409edb561b520d356e332950c700d064d65b6c2ec66c63826811aae7e4c5

    SHA512

    037876fa9238086a784d913bd07bb50026fd3f210cec8fbfd17ad5e8782e7370de333df0e776df8700b005ac483491bfb7e3aae09828b31c80712891f42930be

  • \ProgramData\MicrosoftTemplates-tupe9.5.3.2\MicrosoftTemplates-tupe9.5.3.2.exe
    Filesize

    456.4MB

    MD5

    e09b7ab05f74ce2b7dc1642db7c52960

    SHA1

    5d441896bead384580b460b2ade7d90b229f7d45

    SHA256

    6e9dc2c0dec078cfa247e878f5f2154471c464e3ac17dad08c545eadcb3d041a

    SHA512

    1078fd7f7888d7fbd23bc0709259a047e3647c4ce481d4b422e4d51e34864471b2c8fe09b249d2ce71c7bd57dc93237743579508ed9ba0079fe7af01245577d3

  • \ProgramData\MicrosoftTemplates-tupe9.5.3.2\MicrosoftTemplates-tupe9.5.3.2.exe
    Filesize

    537.1MB

    MD5

    ba2091019d177a8aa9626aefb41c3688

    SHA1

    27bc4502baefcbce7970e8826e058170f4fe19c6

    SHA256

    bce1143556348f747e905e49432ed16d031948882a4e072b72d8d416b8537bcd

    SHA512

    5c1a66d15655307f8f5b7645b203f1f8cd16d1b92729c9235dda32599431fcf503097f634db54161a0b4d4dbdab161de3d29bdc20bda92055dcea292d803075f

  • memory/920-68-0x000000013F090000-0x000000013F921000-memory.dmp
    Filesize

    8.6MB

  • memory/920-69-0x000000013F090000-0x000000013F921000-memory.dmp
    Filesize

    8.6MB

  • memory/920-70-0x000000013F090000-0x000000013F921000-memory.dmp
    Filesize

    8.6MB

  • memory/1388-54-0x000000013F4A0000-0x000000013FD31000-memory.dmp
    Filesize

    8.6MB

  • memory/1388-55-0x000000013F4A0000-0x000000013FD31000-memory.dmp
    Filesize

    8.6MB

  • memory/1388-56-0x000000013F4A0000-0x000000013FD31000-memory.dmp
    Filesize

    8.6MB

  • memory/1388-58-0x000000013F4A0000-0x000000013FD31000-memory.dmp
    Filesize

    8.6MB

  • memory/1388-66-0x000000013F4A0000-0x000000013FD31000-memory.dmp
    Filesize

    8.6MB