40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe
Size

2.2MB
MD5

8f71a17c18a2fb507c483cc9dddc8ac4
SHA1

c7316e4cd40bcd8d2bb93956cead63a7727c986a
SHA256

40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965
SHA512

ec301d4f8f6f9f3f277afcc78fd732f15d5e207d23174ae972ba468d9d3d28896c70f6e864f4ce335f8e2436b0fe7d691c8246c00e0359ccc2f9a1ddf5e7bc10
SSDEEP

49152:Gu4CmV1PmeS0rBMGKCevL0XNQNElZ+dQaIXHQlVZ0qnk:Gu8/Pm6FMfCew9WEz+dQ1k3k

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Wine	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2396	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2396	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2396	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe
2396	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

C:\Users\Admin\AppData\Local\Temp\40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe
"C:\Users\Admin\AppData\Local\Temp\40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2396-0-0x0000000000400000-0x000000000093B000-memory.dmp

Filesize
5.2MB

Download
memory/2396-1-0x0000000077200000-0x0000000077202000-memory.dmp

Filesize
8KB

Download
memory/2396-8-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/2396-10-0x0000000000400000-0x000000000093B000-memory.dmp

Filesize
5.2MB

Download
memory/2396-9-0x00000000044E0000-0x00000000044E1000-memory.dmp

Filesize
4KB

Download
memory/2396-7-0x00000000045C0000-0x00000000045C1000-memory.dmp

Filesize
4KB

Download
memory/2396-11-0x00000000044C0000-0x00000000044C1000-memory.dmp

Filesize
4KB

Download
memory/2396-12-0x00000000045D0000-0x00000000045D1000-memory.dmp

Filesize
4KB

Download
memory/2396-13-0x0000000004620000-0x0000000004621000-memory.dmp

Filesize
4KB

Download
memory/2396-6-0x0000000004590000-0x0000000004592000-memory.dmp

Filesize
8KB

Download
memory/2396-5-0x00000000045A0000-0x00000000045A1000-memory.dmp

Filesize
4KB

Download
memory/2396-4-0x0000000004530000-0x0000000004531000-memory.dmp

Filesize
4KB

Download
memory/2396-2-0x00000000045B0000-0x00000000045B1000-memory.dmp

Filesize
4KB

Download
memory/2396-3-0x0000000004560000-0x0000000004561000-memory.dmp

Filesize
4KB

Download