Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 10:11
Behavioral task
behavioral1
Sample
Woofer_-_Hwid.exe
Resource
win7-20240220-en
General
-
Target
Woofer_-_Hwid.exe
-
Size
5.5MB
-
MD5
44c3f668cf002c241a9121b72139b42d
-
SHA1
0356cce54d3711191e32b150cfbc1367c335af01
-
SHA256
e6e800ea66bfe325aa61ab5c06b60dbce4a7d109c3f6d8f8a62cb693166e3763
-
SHA512
ef2e4759e2a098a711b3a682266029311b1bb6fd460ecec46fa234ddbc661ecc25c1f486e40cbeaaac6e5ed7af092fe8fbe8a6eb431c8e2866425cb7ffc6086f
-
SSDEEP
98304:Fb2rcboUGIj6JWBEQCNy5UuI4EPGEbHDoQb0IoB95uxiPhbQGWqCAv:/boUGzmwNya4B4MQb9owAVWr2
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Woofer_-_Hwid.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Woofer_-_Hwid.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Woofer_-_Hwid.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Woofer_-_Hwid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Woofer_-_Hwid.exe -
Processes:
resource yara_rule behavioral1/memory/2220-9-0x00000000012A0000-0x0000000001F3E000-memory.dmp themida behavioral1/memory/2220-10-0x00000000012A0000-0x0000000001F3E000-memory.dmp themida behavioral1/memory/2704-24-0x0000000140000000-0x00000001405E8000-memory.dmp themida behavioral1/memory/2220-29-0x00000000012A0000-0x0000000001F3E000-memory.dmp themida -
Processes:
Woofer_-_Hwid.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Woofer_-_Hwid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Woofer_-_Hwid.exepid process 2220 Woofer_-_Hwid.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 2704 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Woofer_-_Hwid.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 2220 Woofer_-_Hwid.exe Token: SeDebugPrivilege 2704 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Woofer_-_Hwid.exedescription pid process target process PID 2220 wrote to memory of 2628 2220 Woofer_-_Hwid.exe reg.exe PID 2220 wrote to memory of 2628 2220 Woofer_-_Hwid.exe reg.exe PID 2220 wrote to memory of 2628 2220 Woofer_-_Hwid.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Woofer_-_Hwid.exe"C:\Users\Admin\AppData\Local\Temp\Woofer_-_Hwid.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg.exe" DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGUID /f2⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2220-15-0x00000000012A0000-0x0000000001F3E000-memory.dmpFilesize
12.6MB
-
memory/2220-7-0x000007FE80010000-0x000007FE80011000-memory.dmpFilesize
4KB
-
memory/2220-0-0x00000000012A0000-0x0000000001F3E000-memory.dmpFilesize
12.6MB
-
memory/2220-3-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmpFilesize
432KB
-
memory/2220-16-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmpFilesize
432KB
-
memory/2220-6-0x0000000077880000-0x0000000077A29000-memory.dmpFilesize
1.7MB
-
memory/2220-5-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/2220-4-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmpFilesize
432KB
-
memory/2220-9-0x00000000012A0000-0x0000000001F3E000-memory.dmpFilesize
12.6MB
-
memory/2220-10-0x00000000012A0000-0x0000000001F3E000-memory.dmpFilesize
12.6MB
-
memory/2220-11-0x000007FEF5C20000-0x000007FEF660C000-memory.dmpFilesize
9.9MB
-
memory/2220-18-0x0000000077880000-0x0000000077A29000-memory.dmpFilesize
1.7MB
-
memory/2220-13-0x000000001D330000-0x000000001D706000-memory.dmpFilesize
3.8MB
-
memory/2220-14-0x0000000000B30000-0x0000000000BB0000-memory.dmpFilesize
512KB
-
memory/2220-2-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmpFilesize
432KB
-
memory/2220-1-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmpFilesize
432KB
-
memory/2220-12-0x0000000000B30000-0x0000000000BB0000-memory.dmpFilesize
512KB
-
memory/2220-20-0x000007FEF5C20000-0x000007FEF660C000-memory.dmpFilesize
9.9MB
-
memory/2220-21-0x0000000000B30000-0x0000000000BB0000-memory.dmpFilesize
512KB
-
memory/2220-22-0x0000000000B30000-0x0000000000BB0000-memory.dmpFilesize
512KB
-
memory/2220-32-0x000007FEF5C20000-0x000007FEF660C000-memory.dmpFilesize
9.9MB
-
memory/2220-30-0x000007FEFD6E0000-0x000007FEFD74C000-memory.dmpFilesize
432KB
-
memory/2220-28-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/2220-29-0x00000000012A0000-0x0000000001F3E000-memory.dmpFilesize
12.6MB
-
memory/2220-31-0x0000000077880000-0x0000000077A29000-memory.dmpFilesize
1.7MB
-
memory/2704-25-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2704-24-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2704-33-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2704-34-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB