Analysis

  • max time kernel
    85s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/08/2023, 04:00

General

  • Target

    69bfb28708d9947a180b9ecedaacb4b1ccd93871db1ced88e486420f11188ae7.exe

  • Size

    7.1MB

  • MD5

    c271f8e939b0571f5cf304994d99a907

  • SHA1

    83a62febf50166720f317de48196a663a48acbff

  • SHA256

    69bfb28708d9947a180b9ecedaacb4b1ccd93871db1ced88e486420f11188ae7

  • SHA512

    8405aad43ca03ad5311ba464ce468d782478905fb62393cd7befb3c9a703af354fe2b1b240025a617cdba0d57e932df87f7aace4cce8dcb0c4550e0e721d6bd8

  • SSDEEP

    98304:ovbn0odLiXKnXVUk6Nga4hBWeZa6XmD/IWzFoI2kTYwDjcMV7C8hI6c+WMj1xtTc:Ali2XykeihBWeFXy+IFTYMjc2dZcBMW

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69bfb28708d9947a180b9ecedaacb4b1ccd93871db1ced88e486420f11188ae7.exe
    "C:\Users\Admin\AppData\Local\Temp\69bfb28708d9947a180b9ecedaacb4b1ccd93871db1ced88e486420f11188ae7.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of SetWindowsHookEx
    PID:716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 948
      2⤵
      • Program crash
      PID:3732
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 716 -ip 716
    1⤵
      PID:2728

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/716-0-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-6-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-7-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-8-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-9-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-11-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-10-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-12-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-13-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-14-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-15-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-16-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-17-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-18-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-19-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-20-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-21-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-22-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-23-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-24-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-25-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-26-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-27-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-28-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-29-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-30-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-31-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-32-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-33-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-34-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-35-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-36-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-37-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-38-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

      Filesize

      4KB

    • memory/716-39-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-40-0x0000000004E90000-0x0000000004E91000-memory.dmp

      Filesize

      4KB

    • memory/716-42-0x0000000005910000-0x0000000006174000-memory.dmp

      Filesize

      8.4MB

    • memory/716-46-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-45-0x0000000005910000-0x0000000006174000-memory.dmp

      Filesize

      8.4MB

    • memory/716-50-0x0000000005100000-0x0000000005127000-memory.dmp

      Filesize

      156KB

    • memory/716-51-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-52-0x0000000005100000-0x0000000005127000-memory.dmp

      Filesize

      156KB

    • memory/716-53-0x0000000010000000-0x0000000010424000-memory.dmp

      Filesize

      4.1MB

    • memory/716-78-0x0000000005910000-0x0000000006174000-memory.dmp

      Filesize

      8.4MB

    • memory/716-79-0x0000000005100000-0x0000000005127000-memory.dmp

      Filesize

      156KB