Analysis
-
max time kernel
142s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 21:14
Behavioral task
behavioral1
Sample
73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
General
-
Target
73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe
-
Size
3.8MB
-
MD5
57b8ed83826856318137c44fb1240528
-
SHA1
679ac8ba7651908d6b9abd37624829d264d63d3d
-
SHA256
73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2
-
SHA512
397bb732162bb65d0c8b6ae267389eb7df4ba8bacedc84eebf709413f43e117aeccd10095152848502248953b86b244ed12ba5a7ccda3e3a41c002e5656c8f77
-
SSDEEP
98304:DPlBE1PNDpE44FcH8RNy2lqBehp4t/d6ZCRMi3ivzz:ZqP/yFcH8Ro2W6KVfyvzz
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe -
Processes:
resource yara_rule behavioral1/memory/1424-2-0x0000000000EA0000-0x00000000017D7000-memory.dmp themida behavioral1/memory/1424-1-0x0000000000EA0000-0x00000000017D7000-memory.dmp themida behavioral1/memory/1424-4-0x0000000000EA0000-0x00000000017D7000-memory.dmp themida behavioral1/memory/1424-3-0x0000000000EA0000-0x00000000017D7000-memory.dmp themida behavioral1/memory/1424-7-0x0000000000EA0000-0x00000000017D7000-memory.dmp themida behavioral1/memory/1424-8-0x0000000000EA0000-0x00000000017D7000-memory.dmp themida behavioral1/memory/1424-6-0x0000000000EA0000-0x00000000017D7000-memory.dmp themida behavioral1/memory/1424-5-0x0000000000EA0000-0x00000000017D7000-memory.dmp themida behavioral1/memory/1424-10-0x0000000000EA0000-0x00000000017D7000-memory.dmp themida -
Processes:
73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exepid process 1424 73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2976 1424 WerFault.exe 73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exepid process 1424 73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exedescription pid process target process PID 1424 wrote to memory of 2976 1424 73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe WerFault.exe PID 1424 wrote to memory of 2976 1424 73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe WerFault.exe PID 1424 wrote to memory of 2976 1424 73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe WerFault.exe PID 1424 wrote to memory of 2976 1424 73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe"C:\Users\Admin\AppData\Local\Temp\73af0b9b7f307488445db0ec14597fbe91467c1fdd973a39c59c1e2bc7809de2.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 2522⤵
- Program crash
PID:2976
-