40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe
Size

2.2MB
MD5

8f71a17c18a2fb507c483cc9dddc8ac4
SHA1

c7316e4cd40bcd8d2bb93956cead63a7727c986a
SHA256

40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965
SHA512

ec301d4f8f6f9f3f277afcc78fd732f15d5e207d23174ae972ba468d9d3d28896c70f6e864f4ce335f8e2436b0fe7d691c8246c00e0359ccc2f9a1ddf5e7bc10
SSDEEP

49152:Gu4CmV1PmeS0rBMGKCevL0XNQNElZ+dQaIXHQlVZ0qnk:Gu8/Pm6FMfCew9WEz+dQ1k3k

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Software\Wine	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4676	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4676	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe
4676	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4676	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe
4676	40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe

C:\Users\Admin\AppData\Local\Temp\40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe
"C:\Users\Admin\AppData\Local\Temp\40380b53ced150d2acd81c2dd471ac07a5f6ee3bd9d21632100e646399ea9965.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4676-0-0x0000000000400000-0x000000000093B000-memory.dmp

Filesize
5.2MB

Download
memory/4676-1-0x0000000077324000-0x0000000077326000-memory.dmp

Filesize
8KB

Download
memory/4676-3-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download
memory/4676-4-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/4676-5-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/4676-2-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/4676-6-0x0000000004B00000-0x0000000004B02000-memory.dmp

Filesize
8KB

Download
memory/4676-7-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/4676-8-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/4676-9-0x0000000004A70000-0x0000000004A71000-memory.dmp

Filesize
4KB

Download
memory/4676-10-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/4676-11-0x0000000000400000-0x000000000093B000-memory.dmp

Filesize
5.2MB

Download
memory/4676-12-0x0000000000400000-0x000000000093B000-memory.dmp

Filesize
5.2MB

Download
memory/4676-13-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/4676-14-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/4676-15-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download