05212dfa222beb331feb3fd15b5cd724172032f53c1c38ed9d77c3af49400e13

Analysis

max time kernel
0s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f9a6f72480ac66f318a4f36d1af7dce.exe
Size

512KB
MD5

6f9a6f72480ac66f318a4f36d1af7dce
SHA1

29b00cdeb69385c36a30de25b343fe9295412f97
SHA256

05212dfa222beb331feb3fd15b5cd724172032f53c1c38ed9d77c3af49400e13
SHA512

d5c7516a0a6e194fbc5814f412a331feac5268a0f613b4c2f3b41c82e79cd53c67de0cf1f581ae9d9a59615ba20fda0fdc1a96c1b9ff1c71eaa6474af8d3e3d0
SSDEEP

12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4y:0+h9OY70z+warul3E4y

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6f9a6f72480ac66f318a4f36d1af7dce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	6f9a6f72480ac66f318a4f36d1af7dce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	6f9a6f72480ac66f318a4f36d1af7dce.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1356	6f9a6f72480ac66f318a4f36d1af7dce.exe
1356	6f9a6f72480ac66f318a4f36d1af7dce.exe

C:\Users\Admin\AppData\Local\Temp\6f9a6f72480ac66f318a4f36d1af7dce.exe
"C:\Users\Admin\AppData\Local\Temp\6f9a6f72480ac66f318a4f36d1af7dce.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1356
- C:\Users\Admin\AppData\Local\Temp\n3876\s3876.exe
  "C:\Users\Admin\AppData\Local\Temp\n3876\s3876.exe" b14606a21751543e8104530dhnibzbTrzd1fsSUDTRBwR9hK5MT0UhmboIF1B4j+16I050Fn3TsX9lkkvWgFe1xCAHL39Dk2ihQuzbZxxIGKsH+6YS5xUy4tmjRG9lHC2Suv6P9+HOZ1ZpxfdXMef1V4q15XVq4nTmoa31Qd2n1U580F /v "C:\Users\Admin\AppData\Local\Temp\6f9a6f72480ac66f318a4f36d1af7dce.exe"
  2⤵
  PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\n3876\s3876.exe

Filesize
230KB

MD5
abaf13cb23de482dc944ab5b51ca3aac

SHA1
76837356db96dd56b647aba60f1adbbdc7b200fe

SHA256
b02fad5ac5234401505e1682c86f526951e8ded726687088c30987321f7c105e

SHA512
cc2aac30490511e49e1268f5df9139d176a3b849e663ad3b739e2f1cb50a6e084c465772ded5f694d5ec6f19ac40a57e5e64f7c47515f212476c20cbe9d6bce3

Download Submit
memory/5072-12-0x00007FF9D7880000-0x00007FF9D8221000-memory.dmp

Filesize
9.6MB

Download
memory/5072-14-0x00000000011E0000-0x00000000011F0000-memory.dmp

Filesize
64KB

Download
memory/5072-13-0x00007FF9D7880000-0x00007FF9D8221000-memory.dmp

Filesize
9.6MB

Download
memory/5072-30-0x000000001B9D0000-0x000000001B9E2000-memory.dmp

Filesize
72KB

Download
memory/5072-34-0x000000001CD70000-0x000000001CE0C000-memory.dmp

Filesize
624KB

Download
memory/5072-33-0x000000001C800000-0x000000001CCCE000-memory.dmp

Filesize
4.8MB

Download
memory/5072-35-0x000000001CF20000-0x000000001CF82000-memory.dmp

Filesize
392KB

Download
memory/5072-36-0x00000000011E0000-0x00000000011F0000-memory.dmp

Filesize
64KB

Download
memory/5072-37-0x000000001C2C0000-0x000000001C2C8000-memory.dmp

Filesize
32KB

Download
memory/5072-39-0x00000000011E0000-0x00000000011F0000-memory.dmp

Filesize
64KB

Download
memory/5072-38-0x00000000011E0000-0x00000000011F0000-memory.dmp

Filesize
64KB

Download
memory/5072-40-0x00000000011E0000-0x00000000011F0000-memory.dmp

Filesize
64KB

Download
memory/5072-41-0x00000000011E0000-0x00000000011F0000-memory.dmp

Filesize
64KB

Download
memory/5072-42-0x0000000020990000-0x0000000020E9E000-memory.dmp

Filesize
5.1MB

Download
memory/5072-43-0x000000001E480000-0x000000001E5BC000-memory.dmp

Filesize
1.2MB

Download
memory/5072-44-0x00007FF9D7880000-0x00007FF9D8221000-memory.dmp

Filesize
9.6MB

Download
memory/5072-45-0x00000000011E0000-0x00000000011F0000-memory.dmp

Filesize
64KB

Download
memory/5072-47-0x00007FF9D7880000-0x00007FF9D8221000-memory.dmp

Filesize
9.6MB

Download