Analysis
-
max time kernel
92s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2024 21:15
Behavioral task
behavioral1
Sample
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe
Resource
win7-20231215-en
General
-
Target
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe
-
Size
2.9MB
-
MD5
713b1c97b09d0e633ede2f62556e78b9
-
SHA1
c67835ca9504049a350fdb023ec7975cccce1674
-
SHA256
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0
-
SHA512
fadada8a709662a013a5b7984357d41fb004d3e600274ce2d067f081b246a6c8e764e104ff88c2131343d3a500a855ecd5990b968458d0bef5a1e5a15a99ee50
-
SSDEEP
49152:f9X3GwWO9gJdmbB6v6WELRkyVVgYgHUByjGw4JGP9zwYFHbXZkigd8ljRs1pit:f9pWO96dEu6WCQUBF1CdyiPsW
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe -
Processes:
resource yara_rule behavioral2/memory/4660-0-0x0000000000EF0000-0x0000000001666000-memory.dmp themida behavioral2/memory/4660-2-0x0000000000EF0000-0x0000000001666000-memory.dmp themida behavioral2/memory/4660-3-0x0000000000EF0000-0x0000000001666000-memory.dmp themida behavioral2/memory/4660-4-0x0000000000EF0000-0x0000000001666000-memory.dmp themida behavioral2/memory/4660-5-0x0000000000EF0000-0x0000000001666000-memory.dmp themida behavioral2/memory/4660-6-0x0000000000EF0000-0x0000000001666000-memory.dmp themida behavioral2/memory/4660-7-0x0000000000EF0000-0x0000000001666000-memory.dmp themida behavioral2/memory/4660-8-0x0000000000EF0000-0x0000000001666000-memory.dmp themida behavioral2/memory/4660-573-0x0000000000EF0000-0x0000000001666000-memory.dmp themida behavioral2/memory/4660-1408-0x0000000000EF0000-0x0000000001666000-memory.dmp themida behavioral2/memory/4660-1409-0x0000000000EF0000-0x0000000001666000-memory.dmp themida -
Processes:
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exepid process 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1732 4660 WerFault.exe c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exepid process 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe 4660 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe"C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 9842⤵
- Program crash
PID:1732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4660 -ip 46601⤵PID:2780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.iniFilesize
129B
MD55f54d1240735d46980b776af554f44d3
SHA1acf7707c08973ddfdb27cd361442ccfba355c888
SHA2562c80619d7e7c58257293cda3a878c13e5856f4e06f6f90601276f7b9179c9e07
SHA512b1f542f68a48608ae53904fbe2105bd8f3e544941abb38ec9d24cb7a26f916ef94cfb431cce0c64077dc2934913130d78492914a5e9ffc52f311e68217caef15
-
C:\Users\Admin\Videos\CBhwKBgQD.README.txtFilesize
575B
MD561c324611e6b2e1b180664f7a7982a7e
SHA12fd5af80cbe4c805edc71f1d29fd442eabf7109f
SHA256cfac38a276ea508da50703915692cb8bd9d734ce74dc051239beb68cf89b2b37
SHA5127ec1f946f8f659994899c6b8c9b2e6af61d763882dc419e3e18bf98b5884cfdae16e09c27d308ae022df51ec1ed2e3e9b38e970c94c473669f702c33b4876378
-
memory/4660-3-0x0000000000EF0000-0x0000000001666000-memory.dmpFilesize
7.5MB
-
memory/4660-0-0x0000000000EF0000-0x0000000001666000-memory.dmpFilesize
7.5MB
-
memory/4660-4-0x0000000000EF0000-0x0000000001666000-memory.dmpFilesize
7.5MB
-
memory/4660-5-0x0000000000EF0000-0x0000000001666000-memory.dmpFilesize
7.5MB
-
memory/4660-6-0x0000000000EF0000-0x0000000001666000-memory.dmpFilesize
7.5MB
-
memory/4660-7-0x0000000000EF0000-0x0000000001666000-memory.dmpFilesize
7.5MB
-
memory/4660-8-0x0000000000EF0000-0x0000000001666000-memory.dmpFilesize
7.5MB
-
memory/4660-2-0x0000000000EF0000-0x0000000001666000-memory.dmpFilesize
7.5MB
-
memory/4660-1-0x0000000077AA4000-0x0000000077AA6000-memory.dmpFilesize
8KB
-
memory/4660-573-0x0000000000EF0000-0x0000000001666000-memory.dmpFilesize
7.5MB
-
memory/4660-1408-0x0000000000EF0000-0x0000000001666000-memory.dmpFilesize
7.5MB
-
memory/4660-1409-0x0000000000EF0000-0x0000000001666000-memory.dmpFilesize
7.5MB