Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
11/12/2023, 03:50
Behavioral task
behavioral1
Sample
feedae4200a73b606c862f5665b3c75c.exe
Resource
win7-20231130-en
5 signatures
150 seconds
General
-
Target
feedae4200a73b606c862f5665b3c75c.exe
-
Size
5.0MB
-
MD5
feedae4200a73b606c862f5665b3c75c
-
SHA1
5dcb4cb17f46e01da4b17a3b53fc5d86edf1bf1e
-
SHA256
7a317a588f9dda54702d316bdacb84d641e7ba403d3d71b009a55aafdae61657
-
SHA512
41580b5cd2412986dd92a8822a117698cb41f8d4656dfb8bd0ba6251fd3065b6d8ad3213173f51e4516550804bea079517d441cea1580dfd9bde4836bee33700
-
SSDEEP
98304:kB3MEFDrhzYlUK1U1rKNo2QR0dpsYuM9jFs+fqISACgMb2Ti5kou6lqK:kB31V8lU5KN+R0kYuM9BNfqd1Jwi5kHc
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ feedae4200a73b606c862f5665b3c75c.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion feedae4200a73b606c862f5665b3c75c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion feedae4200a73b606c862f5665b3c75c.exe -
resource yara_rule behavioral1/memory/1864-0-0x000000013FB10000-0x00000001407F7000-memory.dmp themida behavioral1/memory/1864-2-0x000000013FB10000-0x00000001407F7000-memory.dmp themida behavioral1/memory/1864-3-0x000000013FB10000-0x00000001407F7000-memory.dmp themida behavioral1/memory/1864-4-0x000000013FB10000-0x00000001407F7000-memory.dmp themida behavioral1/memory/1864-5-0x000000013FB10000-0x00000001407F7000-memory.dmp themida behavioral1/memory/1864-6-0x000000013FB10000-0x00000001407F7000-memory.dmp themida behavioral1/memory/1864-7-0x000000013FB10000-0x00000001407F7000-memory.dmp themida behavioral1/memory/1864-8-0x000000013FB10000-0x00000001407F7000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA feedae4200a73b606c862f5665b3c75c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1864 feedae4200a73b606c862f5665b3c75c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\feedae4200a73b606c862f5665b3c75c.exe"C:\Users\Admin\AppData\Local\Temp\feedae4200a73b606c862f5665b3c75c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1864