Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-04-2024 01:04
Behavioral task
behavioral1
Sample
ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012.exe
Resource
win10v2004-20240426-en
General
-
Target
ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012.exe
-
Size
2.1MB
-
MD5
efc53c37de9e173100743a694e681f81
-
SHA1
5e9483adcc1ae470f9b5e1a211aaa33125f9a4e6
-
SHA256
ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012
-
SHA512
d8295b06fba3806024d22cd78c32a87138c49f26bd285a1b2aafaf5db946006f2712c5efc711dc49e44c82712277285510afecf509dfc7c59b59f2572c3f2d68
-
SSDEEP
49152:VDnlYTQX1sRnaSWkCnDaHapETFhRKAy4D1KZFPMbDOdlvD+2:VDnN16apkUaHiETFDJ16FPMvUb
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012.exe -
Processes:
resource yara_rule behavioral2/memory/3156-0-0x0000000000F70000-0x00000000015F3000-memory.dmp themida behavioral2/memory/3156-2-0x0000000000F70000-0x00000000015F3000-memory.dmp themida behavioral2/memory/3156-4-0x0000000000F70000-0x00000000015F3000-memory.dmp themida behavioral2/memory/3156-3-0x0000000000F70000-0x00000000015F3000-memory.dmp themida behavioral2/memory/3156-1-0x0000000000F70000-0x00000000015F3000-memory.dmp themida behavioral2/memory/3156-6-0x0000000000F70000-0x00000000015F3000-memory.dmp themida behavioral2/memory/3156-7-0x0000000000F70000-0x00000000015F3000-memory.dmp themida behavioral2/memory/3156-5-0x0000000000F70000-0x00000000015F3000-memory.dmp themida behavioral2/memory/3156-8-0x0000000000F70000-0x00000000015F3000-memory.dmp themida behavioral2/memory/3156-9-0x0000000000F70000-0x00000000015F3000-memory.dmp themida -
Processes:
ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012.exe"C:\Users\Admin\AppData\Local\Temp\ff56a63439be66d81f22c0c6b91c92e8b754b81a3a526259715fa43838202012.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3156-0-0x0000000000F70000-0x00000000015F3000-memory.dmpFilesize
6.5MB
-
memory/3156-2-0x0000000000F70000-0x00000000015F3000-memory.dmpFilesize
6.5MB
-
memory/3156-4-0x0000000000F70000-0x00000000015F3000-memory.dmpFilesize
6.5MB
-
memory/3156-3-0x0000000000F70000-0x00000000015F3000-memory.dmpFilesize
6.5MB
-
memory/3156-1-0x0000000000F70000-0x00000000015F3000-memory.dmpFilesize
6.5MB
-
memory/3156-6-0x0000000000F70000-0x00000000015F3000-memory.dmpFilesize
6.5MB
-
memory/3156-7-0x0000000000F70000-0x00000000015F3000-memory.dmpFilesize
6.5MB
-
memory/3156-5-0x0000000000F70000-0x00000000015F3000-memory.dmpFilesize
6.5MB
-
memory/3156-8-0x0000000000F70000-0x00000000015F3000-memory.dmpFilesize
6.5MB
-
memory/3156-9-0x0000000000F70000-0x00000000015F3000-memory.dmpFilesize
6.5MB