Analysis
-
max time kernel
155s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2023 17:43
Static task
static1
Behavioral task
behavioral1
Sample
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe
Resource
win7-20230220-en
General
-
Target
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe
-
Size
3.0MB
-
MD5
4b32941cd92e048e6a2d16c6069edf62
-
SHA1
5d167b4588575ffbc7a06cd9fa22552dced38951
-
SHA256
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d
-
SHA512
8b5c75642960991648fd18fb2c5421f8d082f0982a4b5950dd091547dc53943fccb287a404593fbb08282188c3c94d75e05c28f1a58f83a5b6559f34a516442e
-
SSDEEP
98304:6fFbrdnYUGkQqOSlBk1G4QBeKW0wnpTX5OIX:6fFbhBMqOxFgW3nRr
Malware Config
Extracted
aurora
94.142.138.215:8081
Signatures
-
Detects any file with a triage score of 10 4 IoCs
This file has been assigned a triage score of 10, indicating a high likelihood of malicious behavior.
Processes:
resource yara_rule behavioral2/memory/1208-135-0x0000000000E60000-0x0000000001682000-memory.dmp triage_score_10 behavioral2/memory/1208-136-0x0000000000E60000-0x0000000001682000-memory.dmp triage_score_10 behavioral2/memory/1208-137-0x0000000000E60000-0x0000000001682000-memory.dmp triage_score_10 behavioral2/memory/1208-138-0x0000000000E60000-0x0000000001682000-memory.dmp triage_score_10 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exepid process 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exepid process 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 4236 WMIC.exe Token: SeSecurityPrivilege 4236 WMIC.exe Token: SeTakeOwnershipPrivilege 4236 WMIC.exe Token: SeLoadDriverPrivilege 4236 WMIC.exe Token: SeSystemProfilePrivilege 4236 WMIC.exe Token: SeSystemtimePrivilege 4236 WMIC.exe Token: SeProfSingleProcessPrivilege 4236 WMIC.exe Token: SeIncBasePriorityPrivilege 4236 WMIC.exe Token: SeCreatePagefilePrivilege 4236 WMIC.exe Token: SeBackupPrivilege 4236 WMIC.exe Token: SeRestorePrivilege 4236 WMIC.exe Token: SeShutdownPrivilege 4236 WMIC.exe Token: SeDebugPrivilege 4236 WMIC.exe Token: SeSystemEnvironmentPrivilege 4236 WMIC.exe Token: SeRemoteShutdownPrivilege 4236 WMIC.exe Token: SeUndockPrivilege 4236 WMIC.exe Token: SeManageVolumePrivilege 4236 WMIC.exe Token: 33 4236 WMIC.exe Token: 34 4236 WMIC.exe Token: 35 4236 WMIC.exe Token: 36 4236 WMIC.exe Token: SeIncreaseQuotaPrivilege 4236 WMIC.exe Token: SeSecurityPrivilege 4236 WMIC.exe Token: SeTakeOwnershipPrivilege 4236 WMIC.exe Token: SeLoadDriverPrivilege 4236 WMIC.exe Token: SeSystemProfilePrivilege 4236 WMIC.exe Token: SeSystemtimePrivilege 4236 WMIC.exe Token: SeProfSingleProcessPrivilege 4236 WMIC.exe Token: SeIncBasePriorityPrivilege 4236 WMIC.exe Token: SeCreatePagefilePrivilege 4236 WMIC.exe Token: SeBackupPrivilege 4236 WMIC.exe Token: SeRestorePrivilege 4236 WMIC.exe Token: SeShutdownPrivilege 4236 WMIC.exe Token: SeDebugPrivilege 4236 WMIC.exe Token: SeSystemEnvironmentPrivilege 4236 WMIC.exe Token: SeRemoteShutdownPrivilege 4236 WMIC.exe Token: SeUndockPrivilege 4236 WMIC.exe Token: SeManageVolumePrivilege 4236 WMIC.exe Token: 33 4236 WMIC.exe Token: 34 4236 WMIC.exe Token: 35 4236 WMIC.exe Token: 36 4236 WMIC.exe Token: SeIncreaseQuotaPrivilege 3340 wmic.exe Token: SeSecurityPrivilege 3340 wmic.exe Token: SeTakeOwnershipPrivilege 3340 wmic.exe Token: SeLoadDriverPrivilege 3340 wmic.exe Token: SeSystemProfilePrivilege 3340 wmic.exe Token: SeSystemtimePrivilege 3340 wmic.exe Token: SeProfSingleProcessPrivilege 3340 wmic.exe Token: SeIncBasePriorityPrivilege 3340 wmic.exe Token: SeCreatePagefilePrivilege 3340 wmic.exe Token: SeBackupPrivilege 3340 wmic.exe Token: SeRestorePrivilege 3340 wmic.exe Token: SeShutdownPrivilege 3340 wmic.exe Token: SeDebugPrivilege 3340 wmic.exe Token: SeSystemEnvironmentPrivilege 3340 wmic.exe Token: SeRemoteShutdownPrivilege 3340 wmic.exe Token: SeUndockPrivilege 3340 wmic.exe Token: SeManageVolumePrivilege 3340 wmic.exe Token: 33 3340 wmic.exe Token: 34 3340 wmic.exe Token: 35 3340 wmic.exe Token: 36 3340 wmic.exe Token: SeIncreaseQuotaPrivilege 3340 wmic.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1208 wrote to memory of 3476 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1208 wrote to memory of 3476 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1208 wrote to memory of 3476 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 3476 wrote to memory of 4236 3476 cmd.exe WMIC.exe PID 3476 wrote to memory of 4236 3476 cmd.exe WMIC.exe PID 3476 wrote to memory of 4236 3476 cmd.exe WMIC.exe PID 1208 wrote to memory of 3340 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe wmic.exe PID 1208 wrote to memory of 3340 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe wmic.exe PID 1208 wrote to memory of 3340 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe wmic.exe PID 1208 wrote to memory of 4400 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1208 wrote to memory of 4400 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1208 wrote to memory of 4400 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 4400 wrote to memory of 4600 4400 cmd.exe WMIC.exe PID 4400 wrote to memory of 4600 4400 cmd.exe WMIC.exe PID 4400 wrote to memory of 4600 4400 cmd.exe WMIC.exe PID 1208 wrote to memory of 808 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1208 wrote to memory of 808 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1208 wrote to memory of 808 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 808 wrote to memory of 2272 808 cmd.exe WMIC.exe PID 808 wrote to memory of 2272 808 cmd.exe WMIC.exe PID 808 wrote to memory of 2272 808 cmd.exe WMIC.exe PID 1208 wrote to memory of 4792 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1208 wrote to memory of 4792 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1208 wrote to memory of 4792 1208 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 4792 wrote to memory of 2784 4792 cmd.exe systeminfo.exe PID 4792 wrote to memory of 2784 4792 cmd.exe systeminfo.exe PID 4792 wrote to memory of 2784 4792 cmd.exe systeminfo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe"C:\Users\Admin\AppData\Local\Temp\a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wmic csproduct get uuid"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\cmd.execmd "/c " systeminfo2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo3⤵
- Gathers system information
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-133-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-134-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-135-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-136-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-137-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-138-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-139-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-140-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-141-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-142-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-143-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-144-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-146-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-147-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-149-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB
-
memory/1208-155-0x0000000000E60000-0x0000000001682000-memory.dmpFilesize
8.1MB