Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 04:49
Static task
static1
General
-
Target
feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exe
-
Size
3.4MB
-
MD5
04038a698d34f3dc35b7a3b2ac11678f
-
SHA1
cda7057d389738aa8da47dff465cb377b94ccfc2
-
SHA256
feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80
-
SHA512
07bee3ddc4a8abddb90d685e812838a067e4ae15b0b5b6b765c850fae4bb6bbc552fbff9060413e726f9790a033f42a5c38aa6ab1dc9779df664310867018d2d
-
SSDEEP
98304:wJuR21C/yIq/dhl/O4i/TksjdFwvhzjMSwRVq:w8D/yIqlhlW4i/QsnwZzjMSeVq
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
SoftwareDistributionTemplates-type8.8.5.3.exeSoftwareDistributionTemplates-type8.8.5.3.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SoftwareDistributionTemplates-type8.8.5.3.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SoftwareDistributionTemplates-type8.8.5.3.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
SoftwareDistributionTemplates-type8.8.5.3.exeSoftwareDistributionTemplates-type8.8.5.3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SoftwareDistributionTemplates-type8.8.5.3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SoftwareDistributionTemplates-type8.8.5.3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SoftwareDistributionTemplates-type8.8.5.3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SoftwareDistributionTemplates-type8.8.5.3.exe -
Executes dropped EXE 2 IoCs
Processes:
SoftwareDistributionTemplates-type8.8.5.3.exeSoftwareDistributionTemplates-type8.8.5.3.exepid process 1012 SoftwareDistributionTemplates-type8.8.5.3.exe 3684 SoftwareDistributionTemplates-type8.8.5.3.exe -
Modifies file permissions 1 TTPs 3 IoCs
Processes:
icacls.exeicacls.exeicacls.exepid process 3840 icacls.exe 3828 icacls.exe 4660 icacls.exe -
Processes:
resource yara_rule C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3.exe upx C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3.exe upx behavioral1/memory/1012-149-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmp upx behavioral1/memory/1012-150-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmp upx behavioral1/memory/1012-151-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmp upx behavioral1/memory/1012-154-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmp upx C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3.exe upx behavioral1/memory/3684-156-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmp upx behavioral1/memory/3684-157-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmp upx behavioral1/memory/3684-158-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmp upx behavioral1/memory/3684-159-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmp upx -
Processes:
SoftwareDistributionTemplates-type8.8.5.3.exeSoftwareDistributionTemplates-type8.8.5.3.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SoftwareDistributionTemplates-type8.8.5.3.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SoftwareDistributionTemplates-type8.8.5.3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exedescription pid process target process PID 1064 set thread context of 2412 1064 feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3200 1064 WerFault.exe feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exeAppLaunch.exedescription pid process target process PID 1064 wrote to memory of 2412 1064 feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exe AppLaunch.exe PID 1064 wrote to memory of 2412 1064 feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exe AppLaunch.exe PID 1064 wrote to memory of 2412 1064 feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exe AppLaunch.exe PID 1064 wrote to memory of 2412 1064 feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exe AppLaunch.exe PID 1064 wrote to memory of 2412 1064 feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exe AppLaunch.exe PID 2412 wrote to memory of 3840 2412 AppLaunch.exe icacls.exe PID 2412 wrote to memory of 3840 2412 AppLaunch.exe icacls.exe PID 2412 wrote to memory of 3840 2412 AppLaunch.exe icacls.exe PID 2412 wrote to memory of 3828 2412 AppLaunch.exe icacls.exe PID 2412 wrote to memory of 3828 2412 AppLaunch.exe icacls.exe PID 2412 wrote to memory of 3828 2412 AppLaunch.exe icacls.exe PID 2412 wrote to memory of 4660 2412 AppLaunch.exe icacls.exe PID 2412 wrote to memory of 4660 2412 AppLaunch.exe icacls.exe PID 2412 wrote to memory of 4660 2412 AppLaunch.exe icacls.exe PID 2412 wrote to memory of 2812 2412 AppLaunch.exe schtasks.exe PID 2412 wrote to memory of 2812 2412 AppLaunch.exe schtasks.exe PID 2412 wrote to memory of 2812 2412 AppLaunch.exe schtasks.exe PID 2412 wrote to memory of 1012 2412 AppLaunch.exe SoftwareDistributionTemplates-type8.8.5.3.exe PID 2412 wrote to memory of 1012 2412 AppLaunch.exe SoftwareDistributionTemplates-type8.8.5.3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exe"C:\Users\Admin\AppData\Local\Temp\feffb56578f598490d64289e16a037ac37c3d46f1df41a4013a6dcef225d7e80.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3" /inheritance:e /deny "admin:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3" /TR "C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3.exe" /SC MINUTE3⤵
- Creates scheduled task(s)
-
C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3.exe"C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 4002⤵
- Program crash
-
C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3.exeC:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3.exeFilesize
747.6MB
MD561c1b4bb05c0dee51c500a8109be706a
SHA12d2e19a0f7e5a4f5424d5d5ff2ca7dced91738c7
SHA2568e0a2d00e9e5fd4165cdfd694813573086d32a0bc8e323a337c881c6199dbf95
SHA512cb165232d56d9e221586877199c79008cc964a0c6687f0b0b3d128ce7dbeafc24c879bd851366212442b700b758d3c4309cf1e2f2e13a8acb0ce4966b796127c
-
C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3.exeFilesize
747.6MB
MD561c1b4bb05c0dee51c500a8109be706a
SHA12d2e19a0f7e5a4f5424d5d5ff2ca7dced91738c7
SHA2568e0a2d00e9e5fd4165cdfd694813573086d32a0bc8e323a337c881c6199dbf95
SHA512cb165232d56d9e221586877199c79008cc964a0c6687f0b0b3d128ce7dbeafc24c879bd851366212442b700b758d3c4309cf1e2f2e13a8acb0ce4966b796127c
-
C:\ProgramData\SoftwareDistributionTemplates-type8.8.5.3\SoftwareDistributionTemplates-type8.8.5.3.exeFilesize
319.6MB
MD5cc46f8f8b96163b1d53683a59ef7fefd
SHA19314e32fbff4b24d0a758e8ff27449603f88c5e1
SHA256674b4fc97cdb3d2db4237e01a5f2b8745429a5767772f06219aaa4d0ec52931e
SHA512220ce1cb6811382e74de5e25328db6b1c159d67da10366515eff8f797005b87968b74c21fc4672510a09c7c6cb94a283e9c8681a419533430943bdd3af1229a6
-
memory/1012-151-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmpFilesize
5.1MB
-
memory/1012-154-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmpFilesize
5.1MB
-
memory/1012-150-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmpFilesize
5.1MB
-
memory/1012-149-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmpFilesize
5.1MB
-
memory/2412-131-0x0000000009170000-0x0000000009180000-memory.dmpFilesize
64KB
-
memory/2412-127-0x0000000009080000-0x000000000908A000-memory.dmpFilesize
40KB
-
memory/2412-126-0x0000000008F20000-0x0000000008FB2000-memory.dmpFilesize
584KB
-
memory/2412-130-0x0000000009170000-0x0000000009180000-memory.dmpFilesize
64KB
-
memory/2412-129-0x0000000009170000-0x0000000009180000-memory.dmpFilesize
64KB
-
memory/2412-118-0x0000000004940000-0x0000000004C9C000-memory.dmpFilesize
3.4MB
-
memory/2412-128-0x0000000009170000-0x0000000009180000-memory.dmpFilesize
64KB
-
memory/2412-125-0x0000000009380000-0x000000000987E000-memory.dmpFilesize
5.0MB
-
memory/3684-156-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmpFilesize
5.1MB
-
memory/3684-157-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmpFilesize
5.1MB
-
memory/3684-158-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmpFilesize
5.1MB
-
memory/3684-159-0x00007FF796FC0000-0x00007FF7974DF000-memory.dmpFilesize
5.1MB