Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 11:15
Behavioral task
behavioral1
Sample
Akira (NEWEST).exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
Akira (NEWEST).exe
-
Size
5.1MB
-
MD5
47feab24e4a7a088fcac9a7067cbf318
-
SHA1
bbe0dcbe7eb3d0fa19b4afb5edff51b7066ec45d
-
SHA256
53285fb142e48bd1a568509c8997067370ac4578b3c92d8c3bc75ecdebc2915f
-
SHA512
6b3b0e289d06839cfd32327dfa1795368601a789c3dc2a0db9f0cce01001a28a584d5c26ce4e46e9002626a1f3ba318e038578e86f00cff489956aace8b419aa
-
SSDEEP
98304:KxNeg5VPsVXSfJHbM+A+PoudLZ1uRhkuoxa4kReiX2+jli:TgTZhHbFddNZ1kroxacUbBi
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Akira (NEWEST).exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Akira (NEWEST).exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Akira (NEWEST).exe -
resource yara_rule behavioral1/memory/2300-0-0x000000013F460000-0x0000000140005000-memory.dmp themida behavioral1/memory/2300-1-0x000000013F460000-0x0000000140005000-memory.dmp themida behavioral1/memory/2300-2-0x000000013F460000-0x0000000140005000-memory.dmp themida behavioral1/memory/2300-3-0x000000013F460000-0x0000000140005000-memory.dmp themida behavioral1/memory/2300-4-0x000000013F460000-0x0000000140005000-memory.dmp themida behavioral1/memory/2300-5-0x000000013F460000-0x0000000140005000-memory.dmp themida behavioral1/memory/2300-6-0x000000013F460000-0x0000000140005000-memory.dmp themida behavioral1/memory/2300-7-0x000000013F460000-0x0000000140005000-memory.dmp themida behavioral1/memory/2300-8-0x000000013F460000-0x0000000140005000-memory.dmp themida behavioral1/memory/2300-9-0x000000013F460000-0x0000000140005000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Akira (NEWEST).exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2104 2300 Akira (NEWEST).exe 29 PID 2300 wrote to memory of 2104 2300 Akira (NEWEST).exe 29 PID 2300 wrote to memory of 2104 2300 Akira (NEWEST).exe 29 PID 2104 wrote to memory of 2144 2104 cmd.exe 30 PID 2104 wrote to memory of 2144 2104 cmd.exe 30 PID 2104 wrote to memory of 2144 2104 cmd.exe 30 PID 2104 wrote to memory of 2968 2104 cmd.exe 31 PID 2104 wrote to memory of 2968 2104 cmd.exe 31 PID 2104 wrote to memory of 2968 2104 cmd.exe 31 PID 2104 wrote to memory of 2916 2104 cmd.exe 32 PID 2104 wrote to memory of 2916 2104 cmd.exe 32 PID 2104 wrote to memory of 2916 2104 cmd.exe 32 PID 2300 wrote to memory of 2728 2300 Akira (NEWEST).exe 33 PID 2300 wrote to memory of 2728 2300 Akira (NEWEST).exe 33 PID 2300 wrote to memory of 2728 2300 Akira (NEWEST).exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\Akira (NEWEST).exe"C:\Users\Admin\AppData\Local\Temp\Akira (NEWEST).exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Akira (NEWEST).exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Akira (NEWEST).exe" MD53⤵PID:2144
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2968
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:2916
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2300 -s 4322⤵PID:2728
-