General
- Target dc0dac2b61f658cd0b570431c02db75151515897bb986f621ce6bb13ba543d4d
- Size 5.6MB
- Sample261110-sdmc5abv2s
- SHA256 dc0dac2b61f658cd0b570431c02db75151515897bb986f621ce6bb13ba543d4d
Malware Config
Targets
-
- Target dc0dac2b61f658cd0b570431c02db75151515897bb986f621ce6bb13ba543d4d
- Size 5.6MB
- SHA256 dc0dac2b61f658cd0b570431c02db75151515897bb986f621ce6bb13ba543d4d
Score9/10Looks for VirtualBox drivers on disk
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
Looks for VMWare drivers on disk
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
Network Service Discovery
Attempt to gather information on host's network.
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Windows Management Instrumentation
2Defense Evasion
Modify Registry
1Virtualization/Sandbox Evasion
3System Checks
1Discovery
File and Directory Discovery
2Network Service Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
3System Information Discovery
6System Network Configuration Discovery
1System Service Discovery
1Virtualization/Sandbox Evasion
3System Checks
1