Analysis
-
max time kernel
142s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-04-2024 12:25
Static task
static1
Behavioral task
behavioral1
Sample
21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exe
Resource
win10v2004-20240226-en
General
-
Target
21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exe
-
Size
2.3MB
-
MD5
7b7a3eb9fd9cbcc795bcf8347c8e41a3
-
SHA1
c52c237ffe963889c590478b31a2c91e7a4fb316
-
SHA256
21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916
-
SHA512
e9543e61c7ff8095572275db92f89baa8202cc7a742cef92be1337030105dbbb9a953e8f2c2f67aac731f10652dc27341741807e432c00c268cf704a4ed1b087
-
SSDEEP
49152:7g69SebPPiKgYyXRR54JUvaGdeebBRVJ7Z9WG01iDtlM8t:7g69SebiMUoOVtWqZlN
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Wine 21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exepid process 3220 21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exepid process 3220 21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exe 3220 21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exe"C:\Users\Admin\AppData\Local\Temp\21395b199ff788decd7b2f416ac2d80682f856ca729f695586c8aec71b333916.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3220-0-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-1-0x0000000077196000-0x0000000077198000-memory.dmpFilesize
8KB
-
memory/3220-2-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/3220-4-0x00000000059B0000-0x00000000059B1000-memory.dmpFilesize
4KB
-
memory/3220-3-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/3220-5-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/3220-7-0x0000000005990000-0x0000000005991000-memory.dmpFilesize
4KB
-
memory/3220-8-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/3220-6-0x0000000005930000-0x0000000005931000-memory.dmpFilesize
4KB
-
memory/3220-9-0x00000000059E0000-0x00000000059E1000-memory.dmpFilesize
4KB
-
memory/3220-10-0x0000000005970000-0x0000000005971000-memory.dmpFilesize
4KB
-
memory/3220-11-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/3220-12-0x0000000005920000-0x0000000005921000-memory.dmpFilesize
4KB
-
memory/3220-13-0x0000000005A00000-0x0000000005A02000-memory.dmpFilesize
8KB
-
memory/3220-14-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-15-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-16-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-17-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-18-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-19-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-20-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-21-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-22-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-23-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-24-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-25-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-26-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-27-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB
-
memory/3220-28-0x0000000000E40000-0x000000000142F000-memory.dmpFilesize
5.9MB