Analysis
-
max time kernel
25s -
max time network
66s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 02:11
Behavioral task
behavioral1
Sample
28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe
Resource
win7-20230220-en
General
-
Target
28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe
-
Size
12.8MB
-
MD5
a03e180f08f32f630aeafc3402ec373a
-
SHA1
658720b09683597920d843d5177a1cc37bbed9f9
-
SHA256
28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3
-
SHA512
eb3f41eb46a2ef94af4f17c0a282212d34042613acc1f29ceef4836d91c74ebd38102933ae325199179e67e767344fcb429fdb1991cc0b0535651de23a7b7db4
-
SSDEEP
196608:lq6DE4kBPWNWDoJ013AK+Iwn9l7W/8mNTaS63eTCR6VQj0tkxiXUjgnDitU4CSt:l5rueWDolKqn9l7zXRGGLrgnDRm
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe -
Processes:
resource yara_rule behavioral2/memory/3980-133-0x00007FF786740000-0x00007FF7889A5000-memory.dmp themida behavioral2/memory/3980-134-0x00007FF786740000-0x00007FF7889A5000-memory.dmp themida behavioral2/memory/3980-135-0x00007FF786740000-0x00007FF7889A5000-memory.dmp themida behavioral2/memory/3980-136-0x00007FF786740000-0x00007FF7889A5000-memory.dmp themida behavioral2/memory/3980-137-0x00007FF786740000-0x00007FF7889A5000-memory.dmp themida behavioral2/memory/3980-138-0x00007FF786740000-0x00007FF7889A5000-memory.dmp themida behavioral2/memory/3980-139-0x00007FF786740000-0x00007FF7889A5000-memory.dmp themida behavioral2/memory/3980-140-0x00007FF786740000-0x00007FF7889A5000-memory.dmp themida behavioral2/memory/3980-141-0x00007FF786740000-0x00007FF7889A5000-memory.dmp themida behavioral2/memory/3980-142-0x00007FF786740000-0x00007FF7889A5000-memory.dmp themida behavioral2/memory/3980-145-0x00007FF786740000-0x00007FF7889A5000-memory.dmp themida -
Processes:
28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exepid process 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe -
Runs ping.exe 1 TTPs 7 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 3796 PING.EXE 4232 PING.EXE 3892 PING.EXE 3164 PING.EXE 2976 PING.EXE 2252 PING.EXE 5024 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exepid process 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exedescription pid process Token: SeShutdownPrivilege 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3980 wrote to memory of 4724 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 3980 wrote to memory of 4724 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 4724 wrote to memory of 2976 4724 cmd.exe PING.EXE PID 4724 wrote to memory of 2976 4724 cmd.exe PING.EXE PID 3980 wrote to memory of 3192 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 3980 wrote to memory of 3192 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 3192 wrote to memory of 2252 3192 cmd.exe PING.EXE PID 3192 wrote to memory of 2252 3192 cmd.exe PING.EXE PID 3980 wrote to memory of 660 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 3980 wrote to memory of 660 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 660 wrote to memory of 5024 660 cmd.exe PING.EXE PID 660 wrote to memory of 5024 660 cmd.exe PING.EXE PID 3980 wrote to memory of 3804 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 3980 wrote to memory of 3804 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 3804 wrote to memory of 3796 3804 cmd.exe PING.EXE PID 3804 wrote to memory of 3796 3804 cmd.exe PING.EXE PID 3980 wrote to memory of 1588 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 3980 wrote to memory of 1588 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 1588 wrote to memory of 4232 1588 cmd.exe PING.EXE PID 1588 wrote to memory of 4232 1588 cmd.exe PING.EXE PID 3980 wrote to memory of 1428 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 3980 wrote to memory of 1428 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 1428 wrote to memory of 3892 1428 cmd.exe PING.EXE PID 1428 wrote to memory of 3892 1428 cmd.exe PING.EXE PID 3980 wrote to memory of 3496 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 3980 wrote to memory of 3496 3980 28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe cmd.exe PID 3496 wrote to memory of 3164 3496 cmd.exe PING.EXE PID 3496 wrote to memory of 3164 3496 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe"C:\Users\Admin\AppData\Local\Temp\28b697be1636fd2f853522358bd24a7215792ff0556849e5623997a2162a37e3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe/c ping -w 120 -n 1 54.39.75.142⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -w 120 -n 1 54.39.75.143⤵
- Runs ping.exe
-
C:\Windows\system32\cmd.exe/c ping -w 120 -n 1 148.113.133.172⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -w 120 -n 1 148.113.133.173⤵
- Runs ping.exe
-
C:\Windows\system32\cmd.exe/c ping -w 120 -n 1 148.113.133.162⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -w 120 -n 1 148.113.133.163⤵
- Runs ping.exe
-
C:\Windows\system32\cmd.exe/c ping -w 120 -n 1 148.113.133.1832⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -w 120 -n 1 148.113.133.1833⤵
- Runs ping.exe
-
C:\Windows\system32\cmd.exe/c ping -w 120 -n 1 148.113.133.1842⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -w 120 -n 1 148.113.133.1843⤵
- Runs ping.exe
-
C:\Windows\system32\cmd.exe/c ping -w 120 -n 1 148.113.133.1852⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -w 120 -n 1 148.113.133.1853⤵
- Runs ping.exe
-
C:\Windows\system32\cmd.exe/c ping -w 120 -n 1 148.113.133.1862⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -w 120 -n 1 148.113.133.1863⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3980-133-0x00007FF786740000-0x00007FF7889A5000-memory.dmpFilesize
34.4MB
-
memory/3980-134-0x00007FF786740000-0x00007FF7889A5000-memory.dmpFilesize
34.4MB
-
memory/3980-135-0x00007FF786740000-0x00007FF7889A5000-memory.dmpFilesize
34.4MB
-
memory/3980-136-0x00007FF786740000-0x00007FF7889A5000-memory.dmpFilesize
34.4MB
-
memory/3980-137-0x00007FF786740000-0x00007FF7889A5000-memory.dmpFilesize
34.4MB
-
memory/3980-138-0x00007FF786740000-0x00007FF7889A5000-memory.dmpFilesize
34.4MB
-
memory/3980-139-0x00007FF786740000-0x00007FF7889A5000-memory.dmpFilesize
34.4MB
-
memory/3980-140-0x00007FF786740000-0x00007FF7889A5000-memory.dmpFilesize
34.4MB
-
memory/3980-141-0x00007FF786740000-0x00007FF7889A5000-memory.dmpFilesize
34.4MB
-
memory/3980-142-0x00007FF786740000-0x00007FF7889A5000-memory.dmpFilesize
34.4MB
-
memory/3980-145-0x00007FF786740000-0x00007FF7889A5000-memory.dmpFilesize
34.4MB