1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936

Analysis

max time kernel
136s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 19:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936.exe
Size

5.7MB
MD5

f44c1df41f4fd09c637e3becf4b453d9
SHA1

a37a648d6100439d711665ee2806d8cc3f94ac54
SHA256

1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936
SHA512

6244b1dc72e45b63f5391f07b0e4083457f6f67bef4a31b1e5d1e3621aca2ef7a7546ec569d0d4cd16b69ded9480e880c5cd77599bd65821a992be73b073480d
SSDEEP

98304:RGOsDD80zhPnrZi93MLSgndFoCyOh1+hsXBh3667QhPKDp+3zcN4Th+leN8CE:n2XpdWML9niOTRF660hPe43zcN4TMl

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Wine	1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2528	1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2528	1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936.exe
2528	1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936.exe

C:\Users\Admin\AppData\Local\Temp\1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936.exe
"C:\Users\Admin\AppData\Local\Temp\1f3131613f09d4c10f188a47c33d61748a44b46fe4697eee052941e032e28936.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-0-0x0000000000400000-0x0000000000BF7000-memory.dmp

Filesize
8.0MB

Download
memory/2528-1-0x0000000077204000-0x0000000077206000-memory.dmp

Filesize
8KB

Download
memory/2528-2-0x0000000000400000-0x0000000000BF7000-memory.dmp

Filesize
8.0MB

Download
memory/2528-3-0x0000000005160000-0x0000000005162000-memory.dmp

Filesize
8KB

Download
memory/2528-4-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/2528-5-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/2528-6-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/2528-7-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/2528-9-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/2528-8-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/2528-10-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/2528-11-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/2528-13-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/2528-12-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/2528-14-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/2528-15-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/2528-16-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/2528-17-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/2528-18-0x0000000000400000-0x0000000000BF7000-memory.dmp

Filesize
8.0MB

Download