Analysis
-
max time kernel
299s -
max time network
179s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
27-03-2023 22:17
Static task
static1
Behavioral task
behavioral1
Sample
b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exe
Resource
win7-20230220-en
General
-
Target
b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exe
-
Size
3.4MB
-
MD5
23f11a7d3c4598a480da9dffa64c07d7
-
SHA1
49c861957c9d335afa9775195f8eea0242c6039b
-
SHA256
b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6
-
SHA512
e8f765e74e71d72a7b7b26dbf4b105556df5deab62caa0e7c621c0353ffe1e75ba4fb5bea5a1ef8c29a4dd5c9d48a86847f3178390b44ff9c2d98768e2c52eb1
-
SSDEEP
98304:BJuR21C/yIq/dhl/O4i/TksjdFwvhzjMSwRVq:B8D/yIqlhlW4i/QsnwZzjMSeVq
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
OracleWindowsHolographicDevices-type2.3.0.8.exeOracleWindowsHolographicDevices-type2.3.0.8.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ OracleWindowsHolographicDevices-type2.3.0.8.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ OracleWindowsHolographicDevices-type2.3.0.8.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
OracleWindowsHolographicDevices-type2.3.0.8.exeOracleWindowsHolographicDevices-type2.3.0.8.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion OracleWindowsHolographicDevices-type2.3.0.8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion OracleWindowsHolographicDevices-type2.3.0.8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion OracleWindowsHolographicDevices-type2.3.0.8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion OracleWindowsHolographicDevices-type2.3.0.8.exe -
Executes dropped EXE 2 IoCs
Processes:
OracleWindowsHolographicDevices-type2.3.0.8.exeOracleWindowsHolographicDevices-type2.3.0.8.exepid process 3600 OracleWindowsHolographicDevices-type2.3.0.8.exe 3716 OracleWindowsHolographicDevices-type2.3.0.8.exe -
Modifies file permissions 1 TTPs 3 IoCs
Processes:
icacls.exeicacls.exeicacls.exepid process 4108 icacls.exe 1924 icacls.exe 1340 icacls.exe -
Processes:
resource yara_rule C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8.exe upx C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8.exe upx behavioral2/memory/3600-148-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmp upx behavioral2/memory/3600-151-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmp upx behavioral2/memory/3600-152-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmp upx behavioral2/memory/3600-153-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmp upx behavioral2/memory/3600-154-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmp upx behavioral2/memory/3600-155-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmp upx C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8.exe upx behavioral2/memory/3716-157-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmp upx behavioral2/memory/3716-158-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmp upx behavioral2/memory/3716-159-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmp upx behavioral2/memory/3716-160-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmp upx -
Processes:
OracleWindowsHolographicDevices-type2.3.0.8.exeOracleWindowsHolographicDevices-type2.3.0.8.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OracleWindowsHolographicDevices-type2.3.0.8.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OracleWindowsHolographicDevices-type2.3.0.8.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exedescription pid process target process PID 2504 set thread context of 4356 2504 b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4968 2504 WerFault.exe b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exeAppLaunch.exedescription pid process target process PID 2504 wrote to memory of 4356 2504 b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exe AppLaunch.exe PID 2504 wrote to memory of 4356 2504 b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exe AppLaunch.exe PID 2504 wrote to memory of 4356 2504 b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exe AppLaunch.exe PID 2504 wrote to memory of 4356 2504 b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exe AppLaunch.exe PID 2504 wrote to memory of 4356 2504 b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exe AppLaunch.exe PID 4356 wrote to memory of 4108 4356 AppLaunch.exe icacls.exe PID 4356 wrote to memory of 4108 4356 AppLaunch.exe icacls.exe PID 4356 wrote to memory of 4108 4356 AppLaunch.exe icacls.exe PID 4356 wrote to memory of 1340 4356 AppLaunch.exe icacls.exe PID 4356 wrote to memory of 1340 4356 AppLaunch.exe icacls.exe PID 4356 wrote to memory of 1340 4356 AppLaunch.exe icacls.exe PID 4356 wrote to memory of 1924 4356 AppLaunch.exe icacls.exe PID 4356 wrote to memory of 1924 4356 AppLaunch.exe icacls.exe PID 4356 wrote to memory of 1924 4356 AppLaunch.exe icacls.exe PID 4356 wrote to memory of 3000 4356 AppLaunch.exe schtasks.exe PID 4356 wrote to memory of 3000 4356 AppLaunch.exe schtasks.exe PID 4356 wrote to memory of 3000 4356 AppLaunch.exe schtasks.exe PID 4356 wrote to memory of 3600 4356 AppLaunch.exe OracleWindowsHolographicDevices-type2.3.0.8.exe PID 4356 wrote to memory of 3600 4356 AppLaunch.exe OracleWindowsHolographicDevices-type2.3.0.8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exe"C:\Users\Admin\AppData\Local\Temp\b578bfb0a7aacb8ccf161359d0c13c8eb71767940756c8e834359f57465972b6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8" /inheritance:e /deny "admin:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8" /TR "C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8.exe" /SC MINUTE3⤵
- Creates scheduled task(s)
-
C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8.exe"C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 4002⤵
- Program crash
-
C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8.exeC:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8.exeFilesize
824.1MB
MD5479e6e2353d3450a7674219403bd4ff1
SHA14839c09a4c7504210f9475800b97bea8f78ba61d
SHA25622dfa9de349f7c3821cd833d159f8ebab0400d2dee2cd86ab3c8d301b89aa355
SHA51233d948b99f6c87c06b43ad70b67ee2ac8690b29964896cbb4ed73559654b523ccfaf740a8ad69bb60470796d9a1ff4fb90fad34bb0fdecfb0787d0e88d09e7f4
-
C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8.exeFilesize
824.1MB
MD5479e6e2353d3450a7674219403bd4ff1
SHA14839c09a4c7504210f9475800b97bea8f78ba61d
SHA25622dfa9de349f7c3821cd833d159f8ebab0400d2dee2cd86ab3c8d301b89aa355
SHA51233d948b99f6c87c06b43ad70b67ee2ac8690b29964896cbb4ed73559654b523ccfaf740a8ad69bb60470796d9a1ff4fb90fad34bb0fdecfb0787d0e88d09e7f4
-
C:\ProgramData\OracleWindowsHolographicDevices-type2.3.0.8\OracleWindowsHolographicDevices-type2.3.0.8.exeFilesize
824.1MB
MD5479e6e2353d3450a7674219403bd4ff1
SHA14839c09a4c7504210f9475800b97bea8f78ba61d
SHA25622dfa9de349f7c3821cd833d159f8ebab0400d2dee2cd86ab3c8d301b89aa355
SHA51233d948b99f6c87c06b43ad70b67ee2ac8690b29964896cbb4ed73559654b523ccfaf740a8ad69bb60470796d9a1ff4fb90fad34bb0fdecfb0787d0e88d09e7f4
-
memory/3600-155-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmpFilesize
5.1MB
-
memory/3600-153-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmpFilesize
5.1MB
-
memory/3600-154-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmpFilesize
5.1MB
-
memory/3600-148-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmpFilesize
5.1MB
-
memory/3600-151-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmpFilesize
5.1MB
-
memory/3600-152-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmpFilesize
5.1MB
-
memory/3716-160-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmpFilesize
5.1MB
-
memory/3716-159-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmpFilesize
5.1MB
-
memory/3716-158-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmpFilesize
5.1MB
-
memory/3716-157-0x00007FF7D4CC0000-0x00007FF7D51DF000-memory.dmpFilesize
5.1MB
-
memory/4356-127-0x00000000095D0000-0x00000000095DA000-memory.dmpFilesize
40KB
-
memory/4356-126-0x0000000009620000-0x00000000096B2000-memory.dmpFilesize
584KB
-
memory/4356-118-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/4356-125-0x0000000009C40000-0x000000000A13E000-memory.dmpFilesize
5.0MB
-
memory/4356-128-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/4356-131-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/4356-130-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB
-
memory/4356-129-0x0000000005620000-0x0000000005630000-memory.dmpFilesize
64KB