Analysis
- max time kernel
136s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
02/06/2024, 22:36
General
- Target 5e2454120e53ec549c1c3b6db83495b2404f3d7c62eacab142856e4e587288f5.exe
- Size 2.7MB
- Sample240602-2jae7ahe7t
- SHA256 5e2454120e53ec549c1c3b6db83495b2404f3d7c62eacab142856e4e587288f5
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- UPX dump on OEP (original entry point) 32 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e2454120e53ec549c1c3b6db83495b2404f3d7c62eacab142856e4e587288f5.exe"C:\Users\Admin\AppData\Local\Temp\5e2454120e53ec549c1c3b6db83495b2404f3d7c62eacab142856e4e587288f5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4152,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/976-0-0x0000000000400000-0x00000000009A9000-memory.dmp
memory/976-1-0x0000000077AA4000-0x0000000077AA6000-memory.dmp
memory/976-2-0x0000000000401000-0x0000000000578000-memory.dmp
memory/976-29-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-45-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-43-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-46-0x0000000000400000-0x00000000009A9000-memory.dmp
memory/976-48-0x0000000000400000-0x00000000009A9000-memory.dmp
memory/976-47-0x0000000000400000-0x00000000009A9000-memory.dmp
memory/976-41-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-39-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-37-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-35-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-33-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-31-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-27-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-26-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-23-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-21-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-17-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-15-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-13-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-9-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-7-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-5-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-3-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-19-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-11-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-4-0x0000000010000000-0x000000001003E000-memory.dmp
memory/976-49-0x0000000000400000-0x00000000009A9000-memory.dmp
memory/976-50-0x0000000000400000-0x00000000009A9000-memory.dmp
memory/976-51-0x0000000000400000-0x00000000009A9000-memory.dmp
memory/976-52-0x0000000000400000-0x00000000009A9000-memory.dmp
memory/976-53-0x0000000000400000-0x00000000009A9000-memory.dmp
memory/976-55-0x0000000000400000-0x00000000009A9000-memory.dmp