Overview

overview

9

Static

static

3

cdc447ef72...dd.exe

windows7-x64

9

cdc447ef72...dd.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cdc447ef72226bd670558f4d008cd7bbe2ef212c06f303593b1176c37991fddd.exe

  • Size

    1.8MB

  • Sample

    241120-d4k6eszlev

  • MD5

    bae2f983b35979b8a3fccd2a46db74ed

  • SHA1

    e71b25abed61aef249535687cf09011624751874

  • SHA256

    cdc447ef72226bd670558f4d008cd7bbe2ef212c06f303593b1176c37991fddd

  • SHA512

    9d9891a3f2a21f83b61c7869ee02991d2ab2e34bcfaf789d11aae368b8d4a398f3549cb27e9eb1e320092f2af130e7803338ce3decfc2d993e65bcca695700e1

  • SSDEEP

    49152:vHeKioQ9joOb15u5TQUTwROo6obBXL16a:vHX0o41g5WRZtZ

Score
9/10
discoveryevasion

Malware Config

Targets

    • Target

      cdc447ef72226bd670558f4d008cd7bbe2ef212c06f303593b1176c37991fddd.exe

    • Size

      1.8MB

    • MD5

      bae2f983b35979b8a3fccd2a46db74ed

    • SHA1

      e71b25abed61aef249535687cf09011624751874

    • SHA256

      cdc447ef72226bd670558f4d008cd7bbe2ef212c06f303593b1176c37991fddd

    • SHA512

      9d9891a3f2a21f83b61c7869ee02991d2ab2e34bcfaf789d11aae368b8d4a398f3549cb27e9eb1e320092f2af130e7803338ce3decfc2d993e65bcca695700e1

    • SSDEEP

      49152:vHeKioQ9joOb15u5TQUTwROo6obBXL16a:vHX0o41g5WRZtZ

    Score
    9/10
    discoveryevasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks