Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2024 02:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
706f338bc4052cb87d1c69cd70de80e9.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
706f338bc4052cb87d1c69cd70de80e9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
706f338bc4052cb87d1c69cd70de80e9.exe
-
Size
47KB
-
MD5
706f338bc4052cb87d1c69cd70de80e9
-
SHA1
6f11ae7f139e261c7768046b5780eb784bcf7a2d
-
SHA256
3e799bf4528c3c0205a15c994ea6007e2cba2aa9b936bedc48689926fbd12030
-
SHA512
bfe06462ec80cdc40a366002d01963aed6039a0243172a16510f215bddf8528340c4d76d8465fcf368125d71c65ead20e0f642f65dd54028a69f2ee7e92e72e7
-
SSDEEP
768:Ba5rLMFvAV6JAfTfO+Q82AgfAUbZ6EdIfc9eDWl0GpTtYcFwVc6K:BmrLMFvG6XbAgflbgEdI5DepDwVcl
Score
9/10
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 706f338bc4052cb87d1c69cd70de80e9.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 706f338bc4052cb87d1c69cd70de80e9.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 706f338bc4052cb87d1c69cd70de80e9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 706f338bc4052cb87d1c69cd70de80e9.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 706f338bc4052cb87d1c69cd70de80e9.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 706f338bc4052cb87d1c69cd70de80e9.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe 4944 706f338bc4052cb87d1c69cd70de80e9.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: SeIncBasePriorityPrivilege 4944 706f338bc4052cb87d1c69cd70de80e9.exe Token: 33 4944 706f338bc4052cb87d1c69cd70de80e9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\706f338bc4052cb87d1c69cd70de80e9.exe"C:\Users\Admin\AppData\Local\Temp\706f338bc4052cb87d1c69cd70de80e9.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944