Analysis
-
max time kernel
68s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 10:29
General
-
Target
410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36.exe
-
Size
8.9MB
-
MD5
46168b6bae327a9d6aa590fbd5a9688a
-
SHA1
b14ef01b29545966e801c3f8b55fb733fbf5f63b
-
SHA256
410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36
-
SHA512
12f375f2259161e0eb1c8b79dedac7369b428ca2d7fb610e8a839db490c5640ceb98751b248d506607895174a8a9a82ecb0656a703ad82c7c6f3610a3cfa28f8
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36.exe"C:\Users\Admin\AppData\Local\Temp\410eac5d77ea5b38a45a44079cba89f1f3fa6234ff16dd63dbde3476ce364b36.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ñ×ȾØÚ½Ïؿ׿˳·Ê¼Ï˳¹Ëγñ·ÐųļӴÀÓºÌÑƵ¸Ó·¸Ñ½ÓÀÙº×ÙÎÀØǼɰË×ÏÁÂÔÂÎзÆÒÂÕÍ»°ÉÖ¾ÅØÙÉË»µÁ¶ÈØÀ³ÅËÊÈѲ¼.exeC:\Users\Admin\AppData\Local\Temp\Ñ×ȾØÚ½Ïؿ׿˳·Ê¼Ï˳¹Ëγñ·ÐųļӴÀÓºÌÑƵ¸Ó·¸Ñ½ÓÀÙº×ÙÎÀØǼɰË×ÏÁÂÔÂÎзÆÒÂÕÍ»°ÉÖ¾ÅØÙÉË»µÁ¶ÈØÀ³ÅËÊÈѲ¼.exe2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Ñ×ȾØÚ½Ïؿ׿˳·Ê¼Ï˳¹Ëγñ·ÐųļӴÀÓºÌÑƵ¸Ó·¸Ñ½ÓÀÙº×ÙÎÀØǼɰË×ÏÁÂÔÂÎзÆÒÂÕÍ»°ÉÖ¾ÅØÙÉË»µÁ¶ÈØÀ³ÅËÊÈѲ¼.exeFilesize
8.2MB
MD5674529115b3d263ab1a05e627d3c674a
SHA11ed47f809af47a23be86dda3a214537e1298d9e0
SHA2566a0f7f99e521ec5038085c330f4a7ed9eb62dbd8e32230537850db1e51b509fc
SHA512cad8113cef9c8f6f79beeeedf965fe9f0f938910ebe57d2212d3c6ce3a2ce683dea5f52dd662ec0e8a538b5ffdf20bc12e1827446ca73d36f2a1c87ebf36f9ec
-
C:\Users\Admin\AppData\Local\Temp\Ñ×ȾØÚ½Ïؿ׿˳·Ê¼Ï˳¹Ëγñ·ÐųļӴÀÓºÌÑƵ¸Ó·¸Ñ½ÓÀÙº×ÙÎÀØǼɰË×ÏÁÂÔÂÎзÆÒÂÕÍ»°ÉÖ¾ÅØÙÉË»µÁ¶ÈØÀ³ÅËÊÈѲ¼.exeFilesize
8.2MB
MD5674529115b3d263ab1a05e627d3c674a
SHA11ed47f809af47a23be86dda3a214537e1298d9e0
SHA2566a0f7f99e521ec5038085c330f4a7ed9eb62dbd8e32230537850db1e51b509fc
SHA512cad8113cef9c8f6f79beeeedf965fe9f0f938910ebe57d2212d3c6ce3a2ce683dea5f52dd662ec0e8a538b5ffdf20bc12e1827446ca73d36f2a1c87ebf36f9ec
-
C:\Windows\uap.iniFilesize
278B
MD5e0a8f53401a7c931fac9e0a5fb185667
SHA19b79f968c3978b535beb58b5549b3c25bd8a0d3a
SHA256ec1ee0a2c41d67aba0d23d7af3cabb96db0fbf5c5ee63f0e919b85bb00bb696c
SHA512125a18ae7688b205204f7deed4d909b92da150923894929bee1cd326dc3453c032bcffb538b98ca617f59c02edd72246afa048170e2a0e106da7b074f87b03c7
-
\Users\Admin\AppData\Local\Temp\Ñ×ȾØÚ½Ïؿ׿˳·Ê¼Ï˳¹Ëγñ·ÐųļӴÀÓºÌÑƵ¸Ó·¸Ñ½ÓÀÙº×ÙÎÀØǼɰË×ÏÁÂÔÂÎзÆÒÂÕÍ»°ÉÖ¾ÅØÙÉË»µÁ¶ÈØÀ³ÅËÊÈѲ¼.exeFilesize
8.2MB
MD5674529115b3d263ab1a05e627d3c674a
SHA11ed47f809af47a23be86dda3a214537e1298d9e0
SHA2566a0f7f99e521ec5038085c330f4a7ed9eb62dbd8e32230537850db1e51b509fc
SHA512cad8113cef9c8f6f79beeeedf965fe9f0f938910ebe57d2212d3c6ce3a2ce683dea5f52dd662ec0e8a538b5ffdf20bc12e1827446ca73d36f2a1c87ebf36f9ec
-
memory/1648-56-0x0000000000000000-mapping.dmp
-
memory/1648-59-0x0000000000400000-0x00000000015D5000-memory.dmpFilesize
17.8MB
-
memory/1648-61-0x0000000010000000-0x0000000010018000-memory.dmpFilesize
96KB
-
memory/1648-62-0x0000000005480000-0x00000000054BE000-memory.dmpFilesize
248KB
-
memory/1648-63-0x0000000006040000-0x000000000658C000-memory.dmpFilesize
5.3MB
-
memory/2044-54-0x0000000075841000-0x0000000075843000-memory.dmpFilesize
8KB