Overview

overview

9

Static

static

7

449adac1f0...cb.exe

windows7-x64

9

449adac1f0...cb.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-03-2023 01:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    449adac1f0940043f26ab1a8b91748360b4d7d9759108d3db6669edd758129cb.exe

  • Size

    5.6MB

  • MD5

    c5d71dbbbc50db8c2762835e83e0bd9c

  • SHA1

    e266d9870fcf13d7072e9e7a6a881a239ac0c523

  • SHA256

    449adac1f0940043f26ab1a8b91748360b4d7d9759108d3db6669edd758129cb

  • SHA512

    4ff07f801849131e621f7fa605c4215f3bd1c4229e1de99b23f3fc7c07c0a798935cb590fa9ea0b9fee1422f771198bbb84a58ad128743e7e90580fb29304bdc

  • SSDEEP

    98304:H7nk+M3jECnNQJkMn33Mbz0Hy5SF+EaIFKedyFY1+EgYO6wLujDo8E+7LtJqfjXC:YLzhMCpQ+1edyePg969JTEX6NZ

Score
9/10
evasionpersistencetrojanupx

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\449adac1f0940043f26ab1a8b91748360b4d7d9759108d3db6669edd758129cb.exe
    "C:\Users\Admin\AppData\Local\Temp\449adac1f0940043f26ab1a8b91748360b4d7d9759108d3db6669edd758129cb.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\ProgramData\regid.1991-06.com.microsoftWindowsHolographicDevices-tupe5.9.5.9\regid.1991-06.com.microsoftWindowsHolographicDevices-tupe5.9.5.9.exe
      "C:\ProgramData\regid.1991-06.com.microsoftWindowsHolographicDevices-tupe5.9.5.9\regid.1991-06.com.microsoftWindowsHolographicDevices-tupe5.9.5.9.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      PID:3308

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\regid.1991-06.com.microsoftWindowsHolographicDevices-tupe5.9.5.9\regid.1991-06.com.microsoftWindowsHolographicDevices-tupe5.9.5.9.exe
    Filesize

    774.1MB

    MD5

    196d9a760c1cbeb321681d751969fd1b

    SHA1

    f77dfa1670d7314d7c9f2d2391bc5fa24eff91c1

    SHA256

    a8c7311622bc91751a1ef3d5e0fcfe3249593aa076cf144ff27eb75e4b9f7b06

    SHA512

    e519f1b923db44a624529f99eab7d5a1c2e8b85e9e8cb4245df05743e16c826fa74132827beb3b6bfbfa7333c5744401e343d6d171b23bcd3de5e68d6f4a38b9

    Download Submit
  • C:\ProgramData\regid.1991-06.com.microsoftWindowsHolographicDevices-tupe5.9.5.9\regid.1991-06.com.microsoftWindowsHolographicDevices-tupe5.9.5.9.exe
    Filesize

    688.8MB

    MD5

    fe406ddda65051a51930a180abdf9c0b

    SHA1

    e41c8e00213f896561d220b9861155f69d963091

    SHA256

    bc3f095be478b2a5e9f765e1efa59d025a8eb27e3c612ca6b22f38bb53b01464

    SHA512

    7818524bb50ed8032e94b92a5443bc276d0e599a71625987df3bfbc683f14e3eb771e757318350ca4870fc6a6255954968111e73595895dca8f6315584d92b0e

    Download Submit
  • C:\ProgramData\regid.1991-06.com.microsoftWindowsHolographicDevices-tupe5.9.5.9\regid.1991-06.com.microsoftWindowsHolographicDevices-tupe5.9.5.9.exe
    Filesize

    645.2MB

    MD5

    2b12ef17c48347cfb8a3869ba9cdba7e

    SHA1

    c7dd10bb836d9e9eb5267db2ea02940f48379e73

    SHA256

    23e6cf625fca7873550496273fda8927c18f43755b0419ccdca7f76898f9907a

    SHA512

    578a36a4ee356f2efac88c6be922b31bbe09aff953da46b434a12f2b4243625b65d03e6740a14592b6386217a35764025352c0af59bc44d0ded668ffeaa01996

    Download Submit
  • memory/3308-147-0x00007FF65B760000-0x00007FF65BFF1000-memory.dmp
    Filesize

    8.6MB

    Download
  • memory/3308-149-0x00007FF65B760000-0x00007FF65BFF1000-memory.dmp
    Filesize

    8.6MB

    Download
  • memory/3308-148-0x00007FF65B760000-0x00007FF65BFF1000-memory.dmp
    Filesize

    8.6MB

    Download
  • memory/3308-150-0x00007FF65B760000-0x00007FF65BFF1000-memory.dmp
    Filesize

    8.6MB

    Download
  • memory/3308-151-0x00007FF65B760000-0x00007FF65BFF1000-memory.dmp
    Filesize

    8.6MB

    Download
  • memory/4680-133-0x00007FF62E130000-0x00007FF62E9C1000-memory.dmp
    Filesize

    8.6MB

    Download
  • memory/4680-134-0x00007FF62E130000-0x00007FF62E9C1000-memory.dmp
    Filesize

    8.6MB

    Download
  • memory/4680-136-0x00007FF62E130000-0x00007FF62E9C1000-memory.dmp
    Filesize

    8.6MB

    Download
  • memory/4680-146-0x00007FF62E130000-0x00007FF62E9C1000-memory.dmp
    Filesize

    8.6MB

    Download