Resubmissions

04-05-2024 21:46

240504-1m4yjafd32 9

04-05-2024 20:58

240504-zskw6sbb2x 10

General

  • Target

    https://github.com/pepeleaks/Wizard-Crypter

  • Sample

    240504-1m4yjafd32

Score
9/10

Malware Config

Targets

    • Target

      https://github.com/pepeleaks/Wizard-Crypter

    Score
    9/10
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Command and Control

Web Service

1
T1102

Tasks