14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
Size

3.3MB
MD5

77ecafee1b0ba32bd4e3b90b6d92a81f
SHA1

59d3e7bd118a34918e3a39d5a680ff75568482bb
SHA256

14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3
SHA512

aa8aaf0c455c80d0dfd17ce67eff54f75f9cdbb92287693bf395cf33cec19ab8063a0e5766c96aa5fc75825db6e9a57d90ccf3698796f4e6875075225a9e1baf
SSDEEP

49152:ZfZDFDHgbjZ766knm3Y3ykj+B8lleKkqI5l+/pDktLE1wGZdcjnGnbPfnzR:npHgbJcmI3t08l3NKM/Sk9rcjnGnb3n

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2640	816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe	31
PID 816 wrote to memory of 2640	816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe	31
PID 816 wrote to memory of 2640	816	14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe	31

C:\Users\Admin\AppData\Local\Temp\14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe
"C:\Users\Admin\AppData\Local\Temp\14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 816 -s 220
  2⤵
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-0-0x0000000000400000-0x0000000000B5A000-memory.dmp

Filesize
7.4MB

Download
memory/816-1-0x0000000000400000-0x0000000000B5A000-memory.dmp

Filesize
7.4MB

Download
memory/816-2-0x0000000000400000-0x0000000000B5A000-memory.dmp

Filesize
7.4MB

Download
memory/816-4-0x0000000000400000-0x0000000000B5A000-memory.dmp

Filesize
7.4MB

Download