Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 12:08

General

  • Target

    7cc1ba586fee26473559976f3f42c89ad62c43872e65341c156aa1d5f9af811c.exe

  • Size

    2.5MB

  • MD5

    8c2274264b2797e30d44411bbd36f942

  • SHA1

    31b37127440193b9c8ecabedc214ef51a41b833c

  • SHA256

    7cc1ba586fee26473559976f3f42c89ad62c43872e65341c156aa1d5f9af811c

  • SHA512

    376c4e25c9edd8984c7eb6585e2ac7aa6a73b4ab9927f6a65c13431bef5c6a956d11ebdc9e6e9c668ad0bf7352679f38a8c68250c82058d9f75c0d9ac6118c61

  • SSDEEP

    49152:u9hzVlHgIJa177HiK+FcON6s90UoSE+yRiW/6A0d2pJ2j73+e:urLAW4HMz9+XyP2pEv

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Unexpected DNS network traffic destination 9 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cc1ba586fee26473559976f3f42c89ad62c43872e65341c156aa1d5f9af811c.exe
    "C:\Users\Admin\AppData\Local\Temp\7cc1ba586fee26473559976f3f42c89ad62c43872e65341c156aa1d5f9af811c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2984-0-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-1-0x0000000077A20000-0x0000000077A22000-memory.dmp

    Filesize

    8KB

  • memory/2984-2-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-12-0x0000000000B10000-0x0000000000B11000-memory.dmp

    Filesize

    4KB

  • memory/2984-11-0x0000000002660000-0x0000000002661000-memory.dmp

    Filesize

    4KB

  • memory/2984-13-0x0000000002610000-0x0000000002611000-memory.dmp

    Filesize

    4KB

  • memory/2984-10-0x0000000000580000-0x0000000000581000-memory.dmp

    Filesize

    4KB

  • memory/2984-9-0x0000000002820000-0x0000000002821000-memory.dmp

    Filesize

    4KB

  • memory/2984-8-0x00000000007E0000-0x00000000007E1000-memory.dmp

    Filesize

    4KB

  • memory/2984-7-0x00000000027F0000-0x00000000027F1000-memory.dmp

    Filesize

    4KB

  • memory/2984-6-0x0000000002800000-0x0000000002801000-memory.dmp

    Filesize

    4KB

  • memory/2984-5-0x00000000026D0000-0x00000000026D1000-memory.dmp

    Filesize

    4KB

  • memory/2984-4-0x0000000002670000-0x0000000002671000-memory.dmp

    Filesize

    4KB

  • memory/2984-3-0x00000000026C0000-0x00000000026C1000-memory.dmp

    Filesize

    4KB

  • memory/2984-14-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-15-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-16-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-17-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-18-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-19-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-20-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-21-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-22-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-23-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-24-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-25-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-26-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-27-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-28-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB

  • memory/2984-29-0x0000000000B70000-0x0000000001205000-memory.dmp

    Filesize

    6.6MB