Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
23/11/2023, 05:36
General
-
Target
Loaders/WZ2 VIP Chair.exe
-
Size
3.7MB
-
MD5
e970f5d850804e51fc3e36696098cdd3
-
SHA1
70b3aa04496a0a47742126a09dc855d9f8ec7e06
-
SHA256
98689e16472da17ee1a75d4f9cb47c8d969d5829eb1b0bc2890f5ba24bccd84a
-
SHA512
67553f09f98e1241dcd332cb9bc59adeb3e8ce100488aa658bf4cf0cbaf1ff92b63ede327126fc008c51a3b384eea45a1ff81b6e91da487abafe5a8691be3ff4
-
SSDEEP
98304:/d+qCR9F8MXE+kWwwhEEjPwRu0aFQ+zdJdBgZ4:3C58kzkWw2VjPwRHaK+JJdBg+
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loaders\WZ2 VIP Chair.exe"C:\Users\Admin\AppData\Local\Temp\Loaders\WZ2 VIP Chair.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.4MB
-
Filesize
10.4MB