Analysis

  • max time kernel
    290s
  • max time network
    262s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27-06-2024 23:25

General

  • Target

    df7d46df171369acb6aebafbd51b6141abdc42a3a197a2620fbc6f5f4556a235.exe

  • Size

    2.3MB

  • MD5

    50c7b9b5377a2cc4ec5ac780b0a3a820

  • SHA1

    7071b065db8fcd5d7fce388e1835395c69cd60bc

  • SHA256

    df7d46df171369acb6aebafbd51b6141abdc42a3a197a2620fbc6f5f4556a235

  • SHA512

    1c663103e30ae798f15aa5df3db259b7041dc52bba685058a1c8ea2c856aa12db8e06170ca0ffc80329837c6cfda54079c329e84ad7f21d9f7fc6cefce60cf8b

  • SSDEEP

    49152:FvOqXrR2f5h56HBgWG97LnZwPnO9jkLIUXJ2HPry84cLtpIPdSJ7FQ:xOqXrRm756HBC97Ln40IUUwvrgSJi

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df7d46df171369acb6aebafbd51b6141abdc42a3a197a2620fbc6f5f4556a235.exe
    "C:\Users\Admin\AppData\Local\Temp\df7d46df171369acb6aebafbd51b6141abdc42a3a197a2620fbc6f5f4556a235.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1912-0-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-1-0x0000000077B64000-0x0000000077B65000-memory.dmp

    Filesize

    4KB

  • memory/1912-2-0x00000000010C1000-0x000000000116D000-memory.dmp

    Filesize

    688KB

  • memory/1912-3-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-4-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-5-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-6-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-7-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-8-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-9-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-10-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-11-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-12-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-13-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-14-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-15-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-16-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-17-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-18-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-19-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-20-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-21-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-22-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-23-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-24-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-25-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-26-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-27-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-28-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-29-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-30-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-31-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-32-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-33-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-34-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB

  • memory/1912-35-0x00000000010C0000-0x00000000016B3000-memory.dmp

    Filesize

    5.9MB