Analysis

  • max time kernel
    141s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 09:15

General

  • Target

    ddbbbcce1c0c2f1000349c6f2af99c7f17c7ce4627ab5aadb2de5cef2b91192c.exe

  • Size

    6.1MB

  • MD5

    ec263038029041fb497f6d644cee9659

  • SHA1

    3f45cf3bb5fa58d9ed53da36352fb4cfe150f1f8

  • SHA256

    ddbbbcce1c0c2f1000349c6f2af99c7f17c7ce4627ab5aadb2de5cef2b91192c

  • SHA512

    eb69ec8dfd6437db99e85a3beb92cb58deeb3f3168b15731c9930afaede7ab5dbcf47650913f102d2fa739e0e5952a7ccd60d740714fce9e8040f62ebcccba79

  • SSDEEP

    98304:i3ChA0UugO2JrslcE4N9l86g04dTSUfJDsTfRmBp9VzP7Bil9HwpSuUqetb3vZXn:nAyMrs086giU2TpSpXA9HvRqgfZelv4

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddbbbcce1c0c2f1000349c6f2af99c7f17c7ce4627ab5aadb2de5cef2b91192c.exe
    "C:\Users\Admin\AppData\Local\Temp\ddbbbcce1c0c2f1000349c6f2af99c7f17c7ce4627ab5aadb2de5cef2b91192c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2424

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\pcsf.ini

          Filesize

          20B

          MD5

          681496ec06a1de0b86c016432b484d1c

          SHA1

          d7cd30308a7865424124b448638ab2701abacb11

          SHA256

          50ea92c083a43e75d9ddb9f578c18c146fe5202f208d1e3ee0c047c7b544dea8

          SHA512

          9626c2013693b6d8dc62a6c26115349f88085f3f90c1b8791d7ce52541fe2f62ccbfad56937d14f762d3960c5dca593f8aa7d6de04b102f5b41a638306d71de0

        • memory/2424-6-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-38-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-5-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-0-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-7-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-8-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-9-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-1-0x0000000074FC0000-0x0000000074FC1000-memory.dmp

          Filesize

          4KB

        • memory/2424-4-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-39-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-37-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-40-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-41-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-42-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-43-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-44-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB

        • memory/2424-45-0x0000000000400000-0x0000000001C93000-memory.dmp

          Filesize

          24.6MB