Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/04/2024, 12:25
Static task
static1
Behavioral task
behavioral1
Sample
d9606515cb5a0414ff98b04e76b97152914c5bd343d26ef5d4a230cd70668368.exe
Resource
win10v2004-20231215-en
General
-
Target
d9606515cb5a0414ff98b04e76b97152914c5bd343d26ef5d4a230cd70668368.exe
-
Size
3.0MB
-
MD5
071c7f1e098d3e1014f311b2d5ba8fd2
-
SHA1
10be2d8cee9fa3fdbd950667fd880b3979e374d5
-
SHA256
d9606515cb5a0414ff98b04e76b97152914c5bd343d26ef5d4a230cd70668368
-
SHA512
91c7883ea98b31401b7be58f40f71d6e1b156e81461ce4d48d051c6a5f52b94e88c31a561c3639c5935ef5be9422cdebdd8094ef9d4756c265d8f2a456a97249
-
SSDEEP
49152:TGQxXG0fvWpg3xl9KL2KWq5HvA7vblIN8Y+S4iP3UqPYs:KQxW04uL9KL2Dq5Hv0blk8YgqP
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ d9606515cb5a0414ff98b04e76b97152914c5bd343d26ef5d4a230cd70668368.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d9606515cb5a0414ff98b04e76b97152914c5bd343d26ef5d4a230cd70668368.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d9606515cb5a0414ff98b04e76b97152914c5bd343d26ef5d4a230cd70668368.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Wine d9606515cb5a0414ff98b04e76b97152914c5bd343d26ef5d4a230cd70668368.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9606515cb5a0414ff98b04e76b97152914c5bd343d26ef5d4a230cd70668368.exe"C:\Users\Admin\AppData\Local\Temp\d9606515cb5a0414ff98b04e76b97152914c5bd343d26ef5d4a230cd70668368.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
PID:2580