Analysis
-
max time kernel
121s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
24-10-2021 14:29
General
-
Target
SenseHack.exe
-
Size
6.0MB
-
MD5
2d2b4c13fb4246dfc4386b45249f26ee
-
SHA1
58a15fb5bb31f999fb59e24cf2ddca4bbada3e53
-
SHA256
99b8eb82a4115370e798d0eda16298be0e7114de973e4d4b6c4a36718c5b8f6e
-
SHA512
d1dc7634bdc4ee0f81f83e0ad157d061b07a0c203e4059976a79390be44c6d8842e314d832db472567c8d63516a301d7ff46cae75fe6990f702181f7a2a3d7b5
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SenseHack.exe"C:\Users\Admin\AppData\Local\Temp\SenseHack.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB