General
- Target e6d93a677c5a76e45239b794815ed8c38955f5a6941e63f762364113bf92b956
- Size 5.6MB
- Sample261113-vjaydsdz4p
- SHA256 e6d93a677c5a76e45239b794815ed8c38955f5a6941e63f762364113bf92b956
Malware Config
Targets
-
- Target e6d93a677c5a76e45239b794815ed8c38955f5a6941e63f762364113bf92b956
- Size 5.6MB
- SHA256 e6d93a677c5a76e45239b794815ed8c38955f5a6941e63f762364113bf92b956
Score9/10Looks for VirtualBox drivers on disk
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
Looks for VMWare drivers on disk
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
Network Service Discovery
Attempt to gather information on host's network.
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Windows Management Instrumentation
2Defense Evasion
Modify Registry
1Virtualization/Sandbox Evasion
3System Checks
1Discovery
File and Directory Discovery
2Network Service Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
3System Information Discovery
6System Network Configuration Discovery
1System Service Discovery
1Virtualization/Sandbox Evasion
3System Checks
1