Analysis
-
max time kernel
291s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/03/2024, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
beac4e6145269334ebaf3d723fa089c0b336dac94ad12da55574b713c496516a.exe
Resource
win7-20240221-en
General
-
Target
beac4e6145269334ebaf3d723fa089c0b336dac94ad12da55574b713c496516a.exe
-
Size
3.0MB
-
MD5
8f596cf662d3070c4778030b0ebf1697
-
SHA1
ca4e9791887dfd346392e84670f3606e08b0da70
-
SHA256
beac4e6145269334ebaf3d723fa089c0b336dac94ad12da55574b713c496516a
-
SHA512
6db0f316dacf5ee6191d1574316ecc1ac7c90c21faf3d60795cb4fd2f9c57724bb1162286a37b104741ce64e63366480a1468a49bdd114e28110c8577f4b820c
-
SSDEEP
49152:Liw3XBdJn9Lr7cm17ZzLhBORsllCvQGgpUGKOn:Ww3xzn9Lrl17NLzOR+m1PGK
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ beac4e6145269334ebaf3d723fa089c0b336dac94ad12da55574b713c496516a.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion beac4e6145269334ebaf3d723fa089c0b336dac94ad12da55574b713c496516a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion beac4e6145269334ebaf3d723fa089c0b336dac94ad12da55574b713c496516a.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Wine beac4e6145269334ebaf3d723fa089c0b336dac94ad12da55574b713c496516a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\beac4e6145269334ebaf3d723fa089c0b336dac94ad12da55574b713c496516a.exe"C:\Users\Admin\AppData\Local\Temp\beac4e6145269334ebaf3d723fa089c0b336dac94ad12da55574b713c496516a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
PID:2784