General
- Target cee7920fb20d82f8e4d12830f740b318997e8af7bcf2a606d0fddcdf2bee621f
- Size 5.6MB
- Sample261012-szsr2acs2v
- SHA256 cee7920fb20d82f8e4d12830f740b318997e8af7bcf2a606d0fddcdf2bee621f
Malware Config
Targets
-
- Target cee7920fb20d82f8e4d12830f740b318997e8af7bcf2a606d0fddcdf2bee621f
- Size 5.6MB
- SHA256 cee7920fb20d82f8e4d12830f740b318997e8af7bcf2a606d0fddcdf2bee621f
Score9/10Looks for VirtualBox drivers on disk
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
Looks for VMWare drivers on disk
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
Network Service Discovery
Attempt to gather information on host's network.
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Windows Management Instrumentation
2Defense Evasion
Modify Registry
1Virtualization/Sandbox Evasion
3System Checks
1Discovery
File and Directory Discovery
2Network Service Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
3System Information Discovery
6System Network Configuration Discovery
1Virtualization/Sandbox Evasion
3System Checks
1