Analysis
-
max time kernel
300s -
max time network
268s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
25-04-2024 22:17
Behavioral task
behavioral1
Sample
026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd.exe
Resource
win7-20240220-en
General
-
Target
026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd.exe
-
Size
2.2MB
-
MD5
6795efba98699a0cae3c4f729b83ace9
-
SHA1
a46482db507cf67307880919b85dc2187d2a2512
-
SHA256
026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd
-
SHA512
12d49b08fec9dfc8efcddd9cfc7bdd3930ebc128f21667da11fc5ab1b80ba5f153608460275cf4f71695ed9b8b91bdf35261a099314b7ea10b39f000eda1a101
-
SSDEEP
49152:Pwr0j3Y/qI2SgJeK3pJ3uwkeUB+C+26jAaa7V03:PW0j3YSI2SgJeKj3tjUcC+26jAaMa
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd.exe -
Processes:
resource yara_rule behavioral2/memory/3924-0-0x0000000000C50000-0x00000000012DA000-memory.dmp themida behavioral2/memory/3924-1-0x0000000000C50000-0x00000000012DA000-memory.dmp themida behavioral2/memory/3924-2-0x0000000000C50000-0x00000000012DA000-memory.dmp themida behavioral2/memory/3924-3-0x0000000000C50000-0x00000000012DA000-memory.dmp themida behavioral2/memory/3924-4-0x0000000000C50000-0x00000000012DA000-memory.dmp themida behavioral2/memory/3924-5-0x0000000000C50000-0x00000000012DA000-memory.dmp themida behavioral2/memory/3924-6-0x0000000000C50000-0x00000000012DA000-memory.dmp themida behavioral2/memory/3924-7-0x0000000000C50000-0x00000000012DA000-memory.dmp themida behavioral2/memory/3924-8-0x0000000000C50000-0x00000000012DA000-memory.dmp themida behavioral2/memory/3924-9-0x0000000000C50000-0x00000000012DA000-memory.dmp themida behavioral2/memory/3924-10-0x0000000000C50000-0x00000000012DA000-memory.dmp themida -
Processes:
026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd.exe"C:\Users\Admin\AppData\Local\Temp\026387aa4411dac1107e403fb44fa90c5a34ec5ab0068af13e3f8f9f0b0f46cd.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3924-0-0x0000000000C50000-0x00000000012DA000-memory.dmpFilesize
6.5MB
-
memory/3924-1-0x0000000000C50000-0x00000000012DA000-memory.dmpFilesize
6.5MB
-
memory/3924-2-0x0000000000C50000-0x00000000012DA000-memory.dmpFilesize
6.5MB
-
memory/3924-3-0x0000000000C50000-0x00000000012DA000-memory.dmpFilesize
6.5MB
-
memory/3924-4-0x0000000000C50000-0x00000000012DA000-memory.dmpFilesize
6.5MB
-
memory/3924-5-0x0000000000C50000-0x00000000012DA000-memory.dmpFilesize
6.5MB
-
memory/3924-6-0x0000000000C50000-0x00000000012DA000-memory.dmpFilesize
6.5MB
-
memory/3924-7-0x0000000000C50000-0x00000000012DA000-memory.dmpFilesize
6.5MB
-
memory/3924-8-0x0000000000C50000-0x00000000012DA000-memory.dmpFilesize
6.5MB
-
memory/3924-9-0x0000000000C50000-0x00000000012DA000-memory.dmpFilesize
6.5MB
-
memory/3924-10-0x0000000000C50000-0x00000000012DA000-memory.dmpFilesize
6.5MB