Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
09/10/2023, 02:31
General
-
Target
cc1e185b834ff04bdedbc0b58bf867f87333c4384642a8aaab6d0bd380e80c66.exe
-
Size
2.7MB
-
MD5
7f113c8d13c388c5b468d4dc3a5bce0d
-
SHA1
944d0993a68c241c65b40b0dc8fdd5aee395b8af
-
SHA256
cc1e185b834ff04bdedbc0b58bf867f87333c4384642a8aaab6d0bd380e80c66
-
SHA512
b91ea5800a76b08833d7905fa1f2a8e2639defb26b17f38b04e7b19826078caf2d2b74794d251600584468682e7d907392f86b2bbbb10f928561ed79cd7e327e
-
SSDEEP
49152:w4GRMcTILl9XORhquCL7yoVVAOsie4MgOG+ebN2yOsWYGeAvuPxNf55ZGOsQ:w4iIvXikyOCONiB65ZVzbZGOT
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc1e185b834ff04bdedbc0b58bf867f87333c4384642a8aaab6d0bd380e80c66.exe"C:\Users\Admin\AppData\Local\Temp\cc1e185b834ff04bdedbc0b58bf867f87333c4384642a8aaab6d0bd380e80c66.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\System32\PING.EXE" www.baidu.com -n 22⤵
- Runs ping.exe
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD56a004b4196400a627b5b6248a2a2dcba
SHA1fa9a555e83a4c3a73e07a728ec92827f55fbcf02
SHA2569cd3e3f97866082f8edfed25d56b40786c2809f264c4f8b10c022403e7f0f101
SHA5121b5cea41dce0742e4ba7a7f3c4bef3eefc92c63d267a306e4098c68b768723abc0f0eace4a486ff3f4b1bb8a74279dd04e9c2a48df9a20125c21209e3d205624
-
Filesize
343B
MD54407dc956281057bba2ba4781fd36d4c
SHA1ae3c6a891eed3b94fb7fa5ac95d75547b5c329f8
SHA256c4005dded283aaaf7cf18f765894689e362c4db9593e72c7e9c41b7ea6314c3f
SHA5121c76fc378261d87118c003bc219973a4f5277c67919bda654eb89ac7504e9c99ba46d1db10d09dac6a0bb1703c12d995929b2791885a7b7d9e243a651ef9d048
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB