General
- Target U674U94Y9W5Z4JJ6.exe
- Size 26.4MB
- Sample261030-2h95esstfx
- SHA256 ed84181c0281a710a5f4be1d4ca882366bd7e7b92e570b5ce4440b7a4f956b1d
Score
9/10
Malware Config
Targets
-
- Target U674U94Y9W5Z4JJ6.exe
- Size 26.4MB
- SHA256 ed84181c0281a710a5f4be1d4ca882366bd7e7b92e570b5ce4440b7a4f956b1d
Score9/10Enumerates VirtualBox registry keys
Looks for VirtualBox Guest Additions in registry
Looks for VMWare Tools registry key
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
3