Overview

overview

9

Static

static

3

09de762b98...b8.exe

windows7-x64

9

09de762b98...b8.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2024, 15:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    09de762b98fe0596ebc110411115ca553bf071b4243889a6e11f84f53ba53eb8.exe

  • Size

    922KB

  • MD5

    1bcf37c39b0d6636b70f77c36ec74ae1

  • SHA1

    b3170ccee0ce4dd6728787617610aeff9369172d

  • SHA256

    09de762b98fe0596ebc110411115ca553bf071b4243889a6e11f84f53ba53eb8

  • SHA512

    69fb83cbf94979f2ecc1835b21cf837bd716be367047ff462f5932d892c01c1d5e9c56b7b7c9b173cb3d4818ff85dd730f0ba5e50416e8e33e706b4731a4762e

  • SSDEEP

    24576:E8Z717dQ9Biw+L9RHhAPF4WANJ6fdO1sUcmN/:EwxGTRwbyev4PUc

Score
9/10
evasion

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09de762b98fe0596ebc110411115ca553bf071b4243889a6e11f84f53ba53eb8.exe
    "C:\Users\Admin\AppData\Local\Temp\09de762b98fe0596ebc110411115ca553bf071b4243889a6e11f84f53ba53eb8.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Maps connected drives based on registry
    • Checks system information in the registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Checks for VirtualBox DLLs, possible anti-VM trick
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\09de762b98fe0596ebc110411115ca553bf071b4243889a6e11f84f53ba53eb8.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Windows\system32\certutil.exe
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\09de762b98fe0596ebc110411115ca553bf071b4243889a6e11f84f53ba53eb8.exe" MD5
        3⤵
          PID:980
        • C:\Windows\system32\find.exe
          find /i /v "md5"
          3⤵
            PID:1160
          • C:\Windows\system32\find.exe
            find /i /v "certutil"
            3⤵
              PID:5100

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1620-0-0x0000025357250000-0x0000025357251000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1620-1-0x00007FF900010000-0x00007FF9002D9000-memory.dmp

                Filesize

                2.8MB

                Download

              • memory/1620-3-0x00007FF900010000-0x00007FF9002D9000-memory.dmp

                Filesize

                2.8MB

                Download

              • memory/1620-43-0x0000025357610000-0x0000025357611000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1620-68-0x00007FF900010000-0x00007FF9002D9000-memory.dmp

                Filesize

                2.8MB

                Download