Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 19:46
Behavioral task
behavioral1
Sample
desync.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
desync.exe
-
Size
7.6MB
-
MD5
7a15474ad603daa01797d79bb62e175a
-
SHA1
888862cdab8da414fb6840c5eebcdd61ce669e21
-
SHA256
81caa3adef4253955af7d8e935d6c6d3c3fb6134fdb9a37e46a3da4695136154
-
SHA512
569bba67fcaf64560409cbde165136bc5148de426314b74d89c33112098d75066c7afb8bb4767ed47fa068c78f1eca8abe5a45907960be4c584045b4c4bef41d
-
SSDEEP
196608:la3mPC8AJfo8ARlJwONkYCamxR2qL9feH0WFOktv0S:I3mC8ufdWlJwONkDamr2qLpeBOYv0S
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
desync.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ desync.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
desync.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion desync.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion desync.exe -
Processes:
resource yara_rule behavioral1/memory/2012-0-0x000000013F5F0000-0x000000014080B000-memory.dmp themida behavioral1/memory/2012-4-0x000000013F5F0000-0x000000014080B000-memory.dmp themida behavioral1/memory/2012-2-0x000000013F5F0000-0x000000014080B000-memory.dmp themida behavioral1/memory/2012-3-0x000000013F5F0000-0x000000014080B000-memory.dmp themida behavioral1/memory/2012-5-0x000000013F5F0000-0x000000014080B000-memory.dmp themida -
Processes:
desync.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA desync.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
desync.exepid process 2012 desync.exe