22888b18b66d99463b3b96a478f73e0cad82f495717f8ba509c3c58177474f95 | Triage

Analysis

max time kernel
147s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 00:34

Sharing

Report Analysis Logs

General

Target

1d49c5cc618392e58460b89f5cb12038.exe
Size

1.7MB
MD5

1d49c5cc618392e58460b89f5cb12038
SHA1

fcc1af1a11f50d93f7500493b3fe19084afa7db2
SHA256

22888b18b66d99463b3b96a478f73e0cad82f495717f8ba509c3c58177474f95
SHA512

e265a47b7aafcead8af9b43c5975b6e2ba62f95098afc1b80a3a4b1eb2e3bddb6c8980741608bab2ff6ed451dc2d26e76d9199f0b3fdc32020dcd63e394832a5
SSDEEP

24576:TJI7H8wlhEodBPziRQkl5m95xNybvdj7FoGp6Bcash2uskeGadbj8ymx+ifPkSuz:SPxH0Mpkdj7KBcc7hjZmHUQlmCo

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1d49c5cc618392e58460b89f5cb12038.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	1d49c5cc618392e58460b89f5cb12038.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1d49c5cc618392e58460b89f5cb12038.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1d49c5cc618392e58460b89f5cb12038.exe

Loads dropped DLL 1 IoCs

pid	Process
3508	1d49c5cc618392e58460b89f5cb12038.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	1d49c5cc618392e58460b89f5cb12038.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	1d49c5cc618392e58460b89f5cb12038.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	1d49c5cc618392e58460b89f5cb12038.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\1d49c5cc618392e58460b89f5cb12038.exe
"C:\Users\Admin\AppData\Local\Temp\1d49c5cc618392e58460b89f5cb12038.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- Checks for VirtualBox DLLs, possible anti-VM trick
PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz45C4.tmp\setup.dll

Filesize
385KB

MD5
7b3515a43a6257cf3909a0eee16c4550

SHA1
8104008c80b1790c8d6051cb05ca1e8663d93c7b

SHA256
ea7f0ccc98c97662550342ba42a9e1815f25f522ef001cb8b03a915abf8235ea

SHA512
5a1827915b94b445fc2e6e8c5f53715610439ce1a4031e85207d7e1854e077354977b7e1b307e159ec6f08d810d6c0513eeb5e0cf526bf25e9602a54b7d6886f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz45C4.tmp\setup.dll

Filesize
381KB

MD5
f6a34e1626afbfae9c833ac8cc3cc193

SHA1
9dadccebae502c2f0e07b9c9f19080e44586ccd8

SHA256
4d4be340f0824daeda6457d284de2ddb69d60da2548282c8e09555440cab0fc1

SHA512
f4d692e007a3c86828a1706e42223790b1026e563976520ecc64c07cfecf3da0a190a4fc2aefa0dc509c9bf0dbeb912c4818e17a95caeba1ab008b47f84dd656

Download Submit
memory/3508-14-0x0000000010000000-0x00000000101EE000-memory.dmp

Filesize
1.9MB

Download
memory/3508-9-0x0000000010000000-0x00000000101EE000-memory.dmp

Filesize
1.9MB

Download
memory/3508-7-0x0000000010000000-0x00000000101EE000-memory.dmp

Filesize
1.9MB

Download
memory/3508-13-0x0000000010000000-0x00000000101EE000-memory.dmp

Filesize
1.9MB

Download
memory/3508-8-0x0000000002C00000-0x0000000002DEB000-memory.dmp

Filesize
1.9MB

Download
memory/3508-6-0x00000000023C0000-0x00000000023C3000-memory.dmp

Filesize
12KB

Download
memory/3508-11-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/3508-12-0x0000000010000000-0x00000000101EE000-memory.dmp

Filesize
1.9MB

Download
memory/3508-16-0x0000000010000000-0x00000000101EE000-memory.dmp

Filesize
1.9MB

Download
memory/3508-15-0x0000000010000000-0x00000000101EE000-memory.dmp

Filesize
1.9MB

Download
memory/3508-21-0x0000000010000000-0x00000000101EE000-memory.dmp

Filesize
1.9MB

Download
memory/3508-32-0x0000000010000000-0x00000000101EE000-memory.dmp

Filesize
1.9MB

Download
memory/3508-33-0x0000000010000000-0x00000000101D3000-memory.dmp

Filesize
1.8MB

Download
memory/3508-34-0x00000000023C0000-0x00000000023C3000-memory.dmp

Filesize
12KB

Download
memory/3508-36-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download