Analysis
-
max time kernel
92s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2024 10:25
Behavioral task
behavioral1
Sample
7ce11aadd05ed2d1bd7b9ec175967387.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
7ce11aadd05ed2d1bd7b9ec175967387.exe
-
Size
3.2MB
-
MD5
7ce11aadd05ed2d1bd7b9ec175967387
-
SHA1
2272ec83ca0e8780fb7255ea4617eff6bbcec59c
-
SHA256
fe16037c2c93276528b2f16cd314bad2ff671cadbd45501674222772883462c1
-
SHA512
c0353dad15faa52116e0dbcbc7feb364823d498822f8a2d5e1cb17e6b282761fdf27def7fac219d98b664278e4954364b06f7ad493f67c2a8ecd40846a6e7c67
-
SSDEEP
98304:izCBMpdSRcCnd0ypVxrGeqECMpcJVlMfgd:Ao5d0ypVxr9qNHVH
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7ce11aadd05ed2d1bd7b9ec175967387.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7ce11aadd05ed2d1bd7b9ec175967387.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7ce11aadd05ed2d1bd7b9ec175967387.exe -
resource yara_rule behavioral2/memory/4800-13-0x0000000000FA0000-0x00000000017FE000-memory.dmp themida behavioral2/memory/4800-14-0x0000000000FA0000-0x00000000017FE000-memory.dmp themida behavioral2/memory/4800-18-0x0000000000FA0000-0x00000000017FE000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7ce11aadd05ed2d1bd7b9ec175967387.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4800 7ce11aadd05ed2d1bd7b9ec175967387.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4800 7ce11aadd05ed2d1bd7b9ec175967387.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ce11aadd05ed2d1bd7b9ec175967387.exe"C:\Users\Admin\AppData\Local\Temp\7ce11aadd05ed2d1bd7b9ec175967387.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4800