2840fc2abb24a746ea1edd7e828affad3a5a1f92dd91778fe2af7f23ed489f7c

General

Target
file.exe
Size 6.6MB
Sample260912-xby2csvvex
SHA256 2840fc2abb24a746ea1edd7e828affad3a5a1f92dd91778fe2af7f23ed489f7c
MD5 3ce4f6ddda3998b385d90b3ee3987008
SHA1 7fc8442e0b3414d5a5b70367d63cb77340d722af
SHA512 f5cd6f59aed0b08858c579f33ea963e7e74141587f64e61d0b46e40556d1f5aee94c69ea565de8e2720ba922cad34c2a5f6969eb24f043449717ba6bec80e327
SSDEEP 98304:Smp5sk02EcQhwzwMNWJkHk4F/PpV3/nA+AY7K/MtujpWjNTpLK:Np02TQhw8GWeE4F/PpVPAeuEcjp2NlLK
TLSH
T17C66C003BD5621E4C89ED6B5CA3A868A3B607C094B3223DB6F55BE349E31BD19C7D704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	file.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	file.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	file.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	file.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	file.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	file.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.lnk	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	file.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{C3EACE32-E013-A8F7-664F-6B97BA49F2AD}\p = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe"	file.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{C3EACE32-E013-A8F7-664F-6B97BA49F2AD}\g = c86bd49b00000000	file.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\CLSID\{C3EACE32-E013-A8F7-664F-6B97BA49F2AD}	file.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4260	file.exe
4260	file.exe
4260	file.exe
4260	file.exe
4260	file.exe
4260	file.exe
4260	file.exe
4260	file.exe
4260	file.exe
4260	file.exe
4260	file.exe
4260	file.exe
4260	file.exe
4260	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Checks computer location settings
- Creates a file in the Startup directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4260