Analysis
-
max time kernel
147s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 00:34
Static task
static1
Behavioral task
behavioral1
Sample
1d49c5cc618392e58460b89f5cb12038.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1d49c5cc618392e58460b89f5cb12038.exe
Resource
win10v2004-20231215-en
General
-
Target
1d49c5cc618392e58460b89f5cb12038.exe
-
Size
1.7MB
-
MD5
1d49c5cc618392e58460b89f5cb12038
-
SHA1
fcc1af1a11f50d93f7500493b3fe19084afa7db2
-
SHA256
22888b18b66d99463b3b96a478f73e0cad82f495717f8ba509c3c58177474f95
-
SHA512
e265a47b7aafcead8af9b43c5975b6e2ba62f95098afc1b80a3a4b1eb2e3bddb6c8980741608bab2ff6ed451dc2d26e76d9199f0b3fdc32020dcd63e394832a5
-
SSDEEP
24576:TJI7H8wlhEodBPziRQkl5m95xNybvdj7FoGp6Bcash2uskeGadbj8ymx+ifPkSuz:SPxH0Mpkdj7KBcc7hjZmHUQlmCo
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1d49c5cc618392e58460b89f5cb12038.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 1d49c5cc618392e58460b89f5cb12038.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1d49c5cc618392e58460b89f5cb12038.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1d49c5cc618392e58460b89f5cb12038.exe -
Loads dropped DLL 1 IoCs
pid Process 3508 1d49c5cc618392e58460b89f5cb12038.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1d49c5cc618392e58460b89f5cb12038.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 1d49c5cc618392e58460b89f5cb12038.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 1d49c5cc618392e58460b89f5cb12038.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d49c5cc618392e58460b89f5cb12038.exe"C:\Users\Admin\AppData\Local\Temp\1d49c5cc618392e58460b89f5cb12038.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- Checks for VirtualBox DLLs, possible anti-VM trick
PID:3508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD57b3515a43a6257cf3909a0eee16c4550
SHA18104008c80b1790c8d6051cb05ca1e8663d93c7b
SHA256ea7f0ccc98c97662550342ba42a9e1815f25f522ef001cb8b03a915abf8235ea
SHA5125a1827915b94b445fc2e6e8c5f53715610439ce1a4031e85207d7e1854e077354977b7e1b307e159ec6f08d810d6c0513eeb5e0cf526bf25e9602a54b7d6886f
-
Filesize
381KB
MD5f6a34e1626afbfae9c833ac8cc3cc193
SHA19dadccebae502c2f0e07b9c9f19080e44586ccd8
SHA2564d4be340f0824daeda6457d284de2ddb69d60da2548282c8e09555440cab0fc1
SHA512f4d692e007a3c86828a1706e42223790b1026e563976520ecc64c07cfecf3da0a190a4fc2aefa0dc509c9bf0dbeb912c4818e17a95caeba1ab008b47f84dd656