c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-03-2023 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

客户端(Client)_KEY.exe
Size

1.2MB
MD5

b0aacc897731ccf1adee875390c6cfcf
SHA1

494182a125ce93921252c79f155d4c10db049899
SHA256

e182e12f86fcc70e57c6ed760c5789e6c1a08dac5b4bfb005509c1a7038e9990
SHA512

b3f8f4793d9b00f1015ea0f9a77a0cf6672fc700036781adf5d5e4c559573f191d4ef982e57e964f7ad107664995d6f5cab6bd20d81f9f6f592602468fab2eab
SSDEEP

24576:4zOhmv9L5ldZz5NLDvHvK2OZkh0y634ek4cKWd6JqjzD8E:wZHzz6y63Jk4bg0VE

Score

9^/10

bootkit evasion persistence

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

客户端(Client)_KEY.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 客户端(Client)_KEY.exe
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

客户端(Client)_KEY.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Wine 客户端(Client)_KEY.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

客户端(Client)_KEY.exe

description ioc process

File opened for modification \??\PhysicalDrive0 客户端(Client)_KEY.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

客户端(Client)_KEY.exe

pid process

1724 客户端(Client)_KEY.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

客户端(Client)_KEY.exe

pid process

1724 客户端(Client)_KEY.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

客户端(Client)_KEY.exe

pid process

1724 客户端(Client)_KEY.exe
1724 客户端(Client)_KEY.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	客户端(Client)_KEY.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Wine	客户端(Client)_KEY.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	客户端(Client)_KEY.exe

pid	process
1724	客户端(Client)_KEY.exe

pid	process
1724	客户端(Client)_KEY.exe

pid	process
1724	客户端(Client)_KEY.exe
1724	客户端(Client)_KEY.exe

C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe
"C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1724

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-54-0x0000000000400000-0x00000000006DF000-memory.dmp

Filesize
2.9MB

Download
memory/1724-56-0x0000000004270000-0x0000000004271000-memory.dmp

Filesize
4KB

Download
memory/1724-55-0x0000000004290000-0x0000000004291000-memory.dmp

Filesize
4KB

Download
memory/1724-58-0x00000000042E0000-0x00000000042E1000-memory.dmp

Filesize
4KB

Download
memory/1724-57-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/1724-60-0x00000000042B0000-0x00000000042B1000-memory.dmp

Filesize
4KB

Download
memory/1724-59-0x0000000004220000-0x0000000004221000-memory.dmp

Filesize
4KB

Download
memory/1724-62-0x0000000004330000-0x0000000004331000-memory.dmp

Filesize
4KB

Download
memory/1724-61-0x0000000004240000-0x0000000004242000-memory.dmp

Filesize
8KB

Download
memory/1724-66-0x0000000004230000-0x0000000004231000-memory.dmp

Filesize
4KB

Download
memory/1724-65-0x0000000004250000-0x0000000004251000-memory.dmp

Filesize
4KB

Download
memory/1724-64-0x0000000004210000-0x0000000004211000-memory.dmp

Filesize
4KB

Download
memory/1724-63-0x0000000004260000-0x0000000004261000-memory.dmp

Filesize
4KB

Download
memory/1724-68-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/1724-67-0x00000000042F0000-0x00000000042F1000-memory.dmp

Filesize
4KB

Download
memory/1724-70-0x0000000004300000-0x0000000004301000-memory.dmp

Filesize
4KB

Download
memory/1724-69-0x0000000004320000-0x0000000004321000-memory.dmp

Filesize
4KB

Download
memory/1724-72-0x0000000004350000-0x0000000004351000-memory.dmp

Filesize
4KB

Download
memory/1724-71-0x00000000043C0000-0x00000000043C1000-memory.dmp

Filesize
4KB

Download
memory/1724-74-0x00000000043A0000-0x00000000043A1000-memory.dmp

Filesize
4KB

Download
memory/1724-73-0x0000000004390000-0x0000000004391000-memory.dmp

Filesize
4KB

Download
memory/1724-76-0x00000000042A0000-0x00000000042A1000-memory.dmp

Filesize
4KB

Download
memory/1724-75-0x00000000043B0000-0x00000000043B1000-memory.dmp

Filesize
4KB

Download
memory/1724-78-0x0000000000400000-0x00000000006DF000-memory.dmp

Filesize
2.9MB

Download