Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
30/06/2024, 21:30
General
-
Target
8e865d5adfc6cf851d189e427ab3d5415fd45d8de065bb470902189bc07a9db8.exe
-
Size
3.7MB
-
MD5
6f53e94dbd37e017301aa544a8c182a5
-
SHA1
b1d3cc7b0e5b6b8b08f98e48231a7779bd1a6c6a
-
SHA256
8e865d5adfc6cf851d189e427ab3d5415fd45d8de065bb470902189bc07a9db8
-
SHA512
6f0711fa76e48b9488991b1887e16df90d1ba61a9b95c6ffef5240e6904e14d896a429e0b0ac477d3e53087ebfd77c008dc4cd0ab976ce090cd181d8ec65f777
-
SSDEEP
98304:/lgpQalSqJ7xojl+11GS0U5pYQ4nGM4OyXlDD:/gRd1ojl6LLYTnGtJl/
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e865d5adfc6cf851d189e427ab3d5415fd45d8de065bb470902189bc07a9db8.exe"C:\Users\Admin\AppData\Local\Temp\8e865d5adfc6cf851d189e427ab3d5415fd45d8de065bb470902189bc07a9db8.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.3MB
-
Filesize
8KB
-
Filesize
10.3MB