Analysis

  • max time kernel
    142s
  • max time network
    92s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-06-2024 21:54

General

  • Target

    08463c9996849b7c6f66d528fd9fca464dd31f9f31b93f660ab9603c80ba6a8c.exe

  • Size

    2.3MB

  • MD5

    bd59ec7f8207cca601b1c4dde61022c5

  • SHA1

    434278ae2e030ce31089bd25dff88cfcffcb02fe

  • SHA256

    08463c9996849b7c6f66d528fd9fca464dd31f9f31b93f660ab9603c80ba6a8c

  • SHA512

    60c70326aca304bbaa8f8f6b6670636ca7732a91a8910c4cf3ee706b24d9cba2cf193755e096c44010db83382b4abfaf19664d31093fcdf0e396ce3d7f4c0456

  • SSDEEP

    49152:bZqIYATiTN7rB7ny/XsQCLSP+c3uTdeFifd4+I5aBGSxhs9yGE8:VqIYATeN7rB89CGP+c3uZt4+t9x29

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08463c9996849b7c6f66d528fd9fca464dd31f9f31b93f660ab9603c80ba6a8c.exe
    "C:\Users\Admin\AppData\Local\Temp\08463c9996849b7c6f66d528fd9fca464dd31f9f31b93f660ab9603c80ba6a8c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3708-0-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-1-0x0000000077666000-0x0000000077668000-memory.dmp

    Filesize

    8KB

  • memory/3708-2-0x0000000001001000-0x00000000010AD000-memory.dmp

    Filesize

    688KB

  • memory/3708-3-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-4-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-5-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-6-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-7-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-8-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-9-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-10-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-11-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-12-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-13-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-14-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-15-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-16-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-17-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-18-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-19-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-20-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB

  • memory/3708-21-0x0000000001000000-0x00000000015E6000-memory.dmp

    Filesize

    5.9MB