Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28-04-2024 10:11
General
-
Target
Woofer_-_Hwid.exe
-
Size
5.5MB
-
MD5
44c3f668cf002c241a9121b72139b42d
-
SHA1
0356cce54d3711191e32b150cfbc1367c335af01
-
SHA256
e6e800ea66bfe325aa61ab5c06b60dbce4a7d109c3f6d8f8a62cb693166e3763
-
SHA512
ef2e4759e2a098a711b3a682266029311b1bb6fd460ecec46fa234ddbc661ecc25c1f486e40cbeaaac6e5ed7af092fe8fbe8a6eb431c8e2866425cb7ffc6086f
-
SSDEEP
98304:Fb2rcboUGIj6JWBEQCNy5UuI4EPGEbHDoQb0IoB95uxiPhbQGWqCAv:/boUGzmwNya4B4MQb9owAVWr2
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Woofer_-_Hwid.exe"C:\Users\Admin\AppData\Local\Temp\Woofer_-_Hwid.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2196-28-0x0000019F0B850000-0x0000019F0B851000-memory.dmpFilesize
4KB
-
memory/2196-33-0x0000019F0B850000-0x0000019F0B851000-memory.dmpFilesize
4KB
-
memory/2196-34-0x0000019F0B850000-0x0000019F0B851000-memory.dmpFilesize
4KB
-
memory/2196-35-0x0000019F0B850000-0x0000019F0B851000-memory.dmpFilesize
4KB
-
memory/2196-36-0x0000019F0B850000-0x0000019F0B851000-memory.dmpFilesize
4KB
-
memory/2196-37-0x0000019F0B850000-0x0000019F0B851000-memory.dmpFilesize
4KB
-
memory/2196-38-0x0000019F0B850000-0x0000019F0B851000-memory.dmpFilesize
4KB
-
memory/2196-32-0x0000019F0B850000-0x0000019F0B851000-memory.dmpFilesize
4KB
-
memory/2196-26-0x0000019F0B850000-0x0000019F0B851000-memory.dmpFilesize
4KB
-
memory/2196-27-0x0000019F0B850000-0x0000019F0B851000-memory.dmpFilesize
4KB
-
memory/4844-7-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmpFilesize
2.0MB
-
memory/4844-10-0x0000000000430000-0x00000000010CE000-memory.dmpFilesize
12.6MB
-
memory/4844-13-0x000001F6DBDA0000-0x000001F6DC176000-memory.dmpFilesize
3.8MB
-
memory/4844-14-0x000001F6DBB90000-0x000001F6DBBA0000-memory.dmpFilesize
64KB
-
memory/4844-16-0x0000000000430000-0x00000000010CE000-memory.dmpFilesize
12.6MB
-
memory/4844-17-0x00007FFB01230000-0x00007FFB014F9000-memory.dmpFilesize
2.8MB
-
memory/4844-18-0x00007FFB02100000-0x00007FFB021BE000-memory.dmpFilesize
760KB
-
memory/4844-20-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmpFilesize
2.0MB
-
memory/4844-21-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmpFilesize
10.8MB
-
memory/4844-23-0x000001F6DBB90000-0x000001F6DBBA0000-memory.dmpFilesize
64KB
-
memory/4844-11-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmpFilesize
10.8MB
-
memory/4844-12-0x000001F6DBB90000-0x000001F6DBBA0000-memory.dmpFilesize
64KB
-
memory/4844-9-0x0000000000430000-0x00000000010CE000-memory.dmpFilesize
12.6MB
-
memory/4844-0-0x0000000000430000-0x00000000010CE000-memory.dmpFilesize
12.6MB
-
memory/4844-6-0x00007FFB00030000-0x00007FFB00031000-memory.dmpFilesize
4KB
-
memory/4844-5-0x00007FFB00000000-0x00007FFB00002000-memory.dmpFilesize
8KB
-
memory/4844-4-0x00007FFB01230000-0x00007FFB014F9000-memory.dmpFilesize
2.8MB
-
memory/4844-3-0x00007FFB02100000-0x00007FFB021BE000-memory.dmpFilesize
760KB
-
memory/4844-1-0x00007FFB01230000-0x00007FFB014F9000-memory.dmpFilesize
2.8MB
-
memory/4844-2-0x00007FFB01230000-0x00007FFB014F9000-memory.dmpFilesize
2.8MB
-
memory/4844-43-0x000001F6DCDC0000-0x000001F6DCE8C000-memory.dmpFilesize
816KB