Analysis
-
max time kernel
91s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
11-05-2024 10:42
General
-
Target
DriverAssist.exe
-
Size
14.8MB
-
MD5
a705d4503c5d46b58f9c62ff101a4493
-
SHA1
7df14bdda16ecbd268566d812bd43963b7b866b0
-
SHA256
e71e9ad7ebebc5b65dcd3a5f6e90041aaf31896fb7733c984b6a603b79f721f4
-
SHA512
ba47a299e9fa9fe781b09c9e8bd78143dca86af239c1525de70a57eef38736fa7e1934314d81618a7340f6f24ba33383f7e388fa5368274e8885bce1134d8960
-
SSDEEP
196608:eTXEzqkShkYHM6bETH24CIj88o5JvqN2ud4nLKr4RElS9OK:e6qk+M6b224CA88ojvwBqKrD+7
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DriverAssist.exe"C:\Users\Admin\AppData\Local\Temp\DriverAssist.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5fc8d9889f08bfad2ae22a0431d37611c
SHA1d0070f64a7729938b8a758a7815c9b12f3b1b47c
SHA256e2ccfe84f229cb31bf5d4c9c81ff3615006ec0192dace8cb67ef07d614e5071a
SHA512595a2ed7aba2e381fcddfc7213dec2a18c42e37416fdafa0e247e8a86eb6be1224256c3cf6302c0dad6d920c9310e8f4c2ced7a692f42a66942e865d40f05112
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
548KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
14.8MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
2.9MB
-
Filesize
2.9MB