Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
20-09-2023 14:25
Behavioral task
behavioral1
Sample
5h8mj5hdmk.exe
Resource
win7-20230831-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5h8mj5hdmk.exe
-
Size
4.0MB
-
MD5
ea4fd817859f3a86dff0d31db268fb4c
-
SHA1
55b83c3f796c8819c169ffc9a5a97341523f1a5b
-
SHA256
b13ac74ea97a14c678375ef454399ca831a205f5c5dd2b29262336e983df6987
-
SHA512
00774e9c110f28cfff842b9aeb05a1f69dbf70d67c0e1a8adc47c6446f1165ca965021659d6a2e04068218b46ac56b91b8e8d95471fd2936e2f9ed0fc3c8264b
-
SSDEEP
98304:DHc0t5nANeQccqG/tkjrNeqngmUYF0/9z+H2n6Y6lQYBdFhs:Q86eQc7OWey1F0wWTOs
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 5h8mj5hdmk.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5h8mj5hdmk.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5h8mj5hdmk.exe -
resource yara_rule behavioral1/memory/1144-0-0x0000000000DC0000-0x000000000180B000-memory.dmp themida behavioral1/memory/1144-2-0x0000000000DC0000-0x000000000180B000-memory.dmp themida behavioral1/memory/1144-3-0x0000000000DC0000-0x000000000180B000-memory.dmp themida behavioral1/memory/1144-4-0x0000000000DC0000-0x000000000180B000-memory.dmp themida behavioral1/memory/1144-5-0x0000000000DC0000-0x000000000180B000-memory.dmp themida behavioral1/memory/1144-6-0x0000000000DC0000-0x000000000180B000-memory.dmp themida behavioral1/memory/1144-7-0x0000000000DC0000-0x000000000180B000-memory.dmp themida behavioral1/memory/1144-8-0x0000000000DC0000-0x000000000180B000-memory.dmp themida behavioral1/memory/1144-9-0x0000000000DC0000-0x000000000180B000-memory.dmp themida behavioral1/memory/1144-16-0x0000000000DC0000-0x000000000180B000-memory.dmp themida behavioral1/memory/1144-17-0x0000000000DC0000-0x000000000180B000-memory.dmp themida behavioral1/memory/1144-18-0x0000000000DC0000-0x000000000180B000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5h8mj5hdmk.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1144 5h8mj5hdmk.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2784 WMIC.exe Token: SeSecurityPrivilege 2784 WMIC.exe Token: SeTakeOwnershipPrivilege 2784 WMIC.exe Token: SeLoadDriverPrivilege 2784 WMIC.exe Token: SeSystemProfilePrivilege 2784 WMIC.exe Token: SeSystemtimePrivilege 2784 WMIC.exe Token: SeProfSingleProcessPrivilege 2784 WMIC.exe Token: SeIncBasePriorityPrivilege 2784 WMIC.exe Token: SeCreatePagefilePrivilege 2784 WMIC.exe Token: SeBackupPrivilege 2784 WMIC.exe Token: SeRestorePrivilege 2784 WMIC.exe Token: SeShutdownPrivilege 2784 WMIC.exe Token: SeDebugPrivilege 2784 WMIC.exe Token: SeSystemEnvironmentPrivilege 2784 WMIC.exe Token: SeRemoteShutdownPrivilege 2784 WMIC.exe Token: SeUndockPrivilege 2784 WMIC.exe Token: SeManageVolumePrivilege 2784 WMIC.exe Token: 33 2784 WMIC.exe Token: 34 2784 WMIC.exe Token: 35 2784 WMIC.exe Token: SeIncreaseQuotaPrivilege 2784 WMIC.exe Token: SeSecurityPrivilege 2784 WMIC.exe Token: SeTakeOwnershipPrivilege 2784 WMIC.exe Token: SeLoadDriverPrivilege 2784 WMIC.exe Token: SeSystemProfilePrivilege 2784 WMIC.exe Token: SeSystemtimePrivilege 2784 WMIC.exe Token: SeProfSingleProcessPrivilege 2784 WMIC.exe Token: SeIncBasePriorityPrivilege 2784 WMIC.exe Token: SeCreatePagefilePrivilege 2784 WMIC.exe Token: SeBackupPrivilege 2784 WMIC.exe Token: SeRestorePrivilege 2784 WMIC.exe Token: SeShutdownPrivilege 2784 WMIC.exe Token: SeDebugPrivilege 2784 WMIC.exe Token: SeSystemEnvironmentPrivilege 2784 WMIC.exe Token: SeRemoteShutdownPrivilege 2784 WMIC.exe Token: SeUndockPrivilege 2784 WMIC.exe Token: SeManageVolumePrivilege 2784 WMIC.exe Token: 33 2784 WMIC.exe Token: 34 2784 WMIC.exe Token: 35 2784 WMIC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1144 wrote to memory of 2664 1144 5h8mj5hdmk.exe 30 PID 1144 wrote to memory of 2664 1144 5h8mj5hdmk.exe 30 PID 1144 wrote to memory of 2664 1144 5h8mj5hdmk.exe 30 PID 1144 wrote to memory of 2664 1144 5h8mj5hdmk.exe 30 PID 1144 wrote to memory of 2668 1144 5h8mj5hdmk.exe 31 PID 1144 wrote to memory of 2668 1144 5h8mj5hdmk.exe 31 PID 1144 wrote to memory of 2668 1144 5h8mj5hdmk.exe 31 PID 1144 wrote to memory of 2668 1144 5h8mj5hdmk.exe 31 PID 2668 wrote to memory of 2784 2668 cmd.exe 32 PID 2668 wrote to memory of 2784 2668 cmd.exe 32 PID 2668 wrote to memory of 2784 2668 cmd.exe 32 PID 2668 wrote to memory of 2784 2668 cmd.exe 32 PID 1144 wrote to memory of 2536 1144 5h8mj5hdmk.exe 35 PID 1144 wrote to memory of 2536 1144 5h8mj5hdmk.exe 35 PID 1144 wrote to memory of 2536 1144 5h8mj5hdmk.exe 35 PID 1144 wrote to memory of 2536 1144 5h8mj5hdmk.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\5h8mj5hdmk.exe"C:\Users\Admin\AppData\Local\Temp\5h8mj5hdmk.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2664
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic PATH Win32_VideoController GET Description,PNPDeviceID2⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic PATH Win32_VideoController GET Description,PNPDeviceID3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2536
-