4fb69e03de0b28dcee40c33612e99c904190603731ff9170298afc13a5b92df3 | Triage

Sharing

General

Target

4340ab60f6f25790de572b0bc89f9f70N.exe
Size

4.7MB
Sample

240803-d2ycza1hrk
MD5

4340ab60f6f25790de572b0bc89f9f70
SHA1

3320add7d3086daea41c4d078d39cda6d359ef82
SHA256

4fb69e03de0b28dcee40c33612e99c904190603731ff9170298afc13a5b92df3
SHA512

92c9901ff2ca2be113c6a251e4dbedb1625d8f46b1039962a768c28a22da40d434337a5260f40447569c53642e2979390442343248a095005f855aa955bf87ad
SSDEEP

98304:a7loogp/2c3NtzqycZWLvExTTeIcNI15FeM+Kow:a7loo4/2YtWycITExTTeDYQc

Score

9^/10

discovery evasion

Malware Config

Targets

- Target
  
  4340ab60f6f25790de572b0bc89f9f70N.exe
- Size
  
  4.7MB
- MD5
  
  4340ab60f6f25790de572b0bc89f9f70
- SHA1
  
  3320add7d3086daea41c4d078d39cda6d359ef82
- SHA256
  
  4fb69e03de0b28dcee40c33612e99c904190603731ff9170298afc13a5b92df3
- SHA512
  
  92c9901ff2ca2be113c6a251e4dbedb1625d8f46b1039962a768c28a22da40d434337a5260f40447569c53642e2979390442343248a095005f855aa955bf87ad
- SSDEEP
  
  98304:a7loogp/2c3NtzqycZWLvExTTeIcNI15FeM+Kow:a7loo4/2YtWycITExTTeDYQc
Score

9^/10

discovery evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasion

behavioral2

discoveryevasion