Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
08/10/2023, 11:37
General
-
Target
a8194f2b24d6b6511899a30a0d3aaa12217406dc7863e0cec42475aa7c3f4132.exe
-
Size
6.1MB
-
MD5
3cfc9ae205511aee6412d9777eab0ae8
-
SHA1
faea5bf1780088e682c1d1ceaa454ecfc6fc6882
-
SHA256
a8194f2b24d6b6511899a30a0d3aaa12217406dc7863e0cec42475aa7c3f4132
-
SHA512
89ec9dbfe9cead6e3ea98ef4ea1b5c3c94dd5d34409ac182873a37beee421329db9a2b0afb96c6ac161f7ae41329a0f65f292075f2bd4b5af69ad5317b0ea629
-
SSDEEP
98304:taAoMaqfStnkpT9w8pJ2KOjEZbRXUyi+FdFfEb0nVtBPi2zXVlienB+F:taxMaqfSapT9ppDPX/mSzw+y
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8194f2b24d6b6511899a30a0d3aaa12217406dc7863e0cec42475aa7c3f4132.exe"C:\Users\Admin\AppData\Local\Temp\a8194f2b24d6b6511899a30a0d3aaa12217406dc7863e0cec42475aa7c3f4132.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 4922⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.6MB
-
Filesize
8KB
-
Filesize
9.6MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
9.6MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB