Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-06-2022 23:34
Static task
static1
Behavioral task
behavioral1
Sample
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe
Resource
win7-20220414-en
General
-
Target
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe
-
Size
8.5MB
-
MD5
ee535a8ea4f5a528203b7fed911f0cdd
-
SHA1
5cf4a8b0b3acab1f68df9792677a4dbd4da8dca2
-
SHA256
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9
-
SHA512
e47f3a0622977eec135c3750838aa38c1ea40d7df372cebd56b19f1297fb7dd3d0beb6ddbe6cfdd54bd8d2b02ecd40081608e93f124dc6456c48679306f0a8ce
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/reverse_winhttp
https://213.186.35.153:8080/Q1NSuetz0_jexd_EgquNYw_WOENe-eLtpUPsAQJFSgu
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exeMSBuild.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ MSBuild.exe -
Processes:
resource yara_rule behavioral2/memory/2736-133-0x0000000066000000-0x000000006618C000-memory.dmp upx behavioral2/memory/2736-136-0x0000000066000000-0x000000006618C000-memory.dmp upx behavioral2/memory/2736-139-0x0000000066000000-0x000000006618C000-memory.dmp upx behavioral2/memory/2736-145-0x0000000066000000-0x000000006618C000-memory.dmp upx behavioral2/memory/2736-156-0x0000000066000000-0x000000006618C000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exeMSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion MSBuild.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Wine MSBuild.exe -
Loads dropped DLL 2 IoCs
Processes:
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exepid process 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe -
Processes:
resource yara_rule behavioral2/memory/2736-130-0x0000000000400000-0x0000000001836000-memory.dmp themida behavioral2/memory/2736-138-0x0000000000400000-0x0000000001836000-memory.dmp themida behavioral2/memory/2736-137-0x0000000000400000-0x0000000001836000-memory.dmp themida behavioral2/memory/2736-140-0x0000000000400000-0x0000000001836000-memory.dmp themida behavioral2/memory/2736-141-0x0000000000400000-0x0000000001836000-memory.dmp themida behavioral2/memory/2736-154-0x0000000000400000-0x0000000001836000-memory.dmp themida -
Processes:
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exeMSBuild.exepid process 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe 3032 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exedescription pid process target process PID 2736 set thread context of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 64 IoCs
Processes:
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\Version = "6.0" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\TypeLib 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\ProxyStubClsid32 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\ = "_DDataBoundClass" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\TypeLib\Version = "6.0" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\ProxyStubClsid32 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\ = "_DClass" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\TypeLib 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\TypeLib\Version = "6.0" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\TypeLib 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ = "DataObject" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ = "AmbientProperties" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\ = "_DDataSourceClass" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049}\ = "_DDataBoundAndDataSourceClass" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\TypeLib 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\TypeLib\Version = "6.0" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\TypeLib 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ProxyStubClsid32 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\ProxyStubClsid32 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\TypeLib\Version = "6.0" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\TypeLib\Version = "6.0" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ProxyStubClsid32 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\TypeLib\Version = "6.0" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\ProxyStubClsid32 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442} 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C} 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\ = "AsyncProperty_VB5" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C1-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E43FD401-8715-11D1-98E7-00A0C9702442}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C4-4442-11D1-8906-00A0C9110049} 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C} 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F0-7697-11D1-A1E9-00A0C90F2731}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\TypeLib\Version = "6.0" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\ = "Hyperlink" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\TypeLib 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B} 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\ = "DataMembers" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{888A5A60-B283-11CF-8AD5-00A0C90AEA82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0324960-2AAA-11CF-AD67-00AA00614F3E} 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731} 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C466B8-499F-101B-BB78-00AA00383CBB}\ = "_ErrObject" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D761-6018-11CF-9016-00AA0068841E}\TypeLib\Version = "6.0" 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exeMSBuild.exepid process 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe 3032 MSBuild.exe 3032 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exepid process 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exedescription pid process target process PID 2736 wrote to memory of 1056 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe schtasks.exe PID 2736 wrote to memory of 1056 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe schtasks.exe PID 2736 wrote to memory of 1056 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe schtasks.exe PID 2736 wrote to memory of 2988 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 2988 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 2988 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe PID 2736 wrote to memory of 3032 2736 33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe"C:\Users\Admin\AppData\Local\Temp\33ee7ae472e679c8f3b53370f9eba8fa58c923ec1831525f56524fc9963353a9.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /TN REV_6266 /TR "'wscript.exe' C:\Users\Admin\AppData\Roaming\{835Q-TPDQ-WI4G-5WBF-YIQX-L57Y}\\Silent.vbs C:\Users\Admin\AppData\Roaming\{835Q-TPDQ-WI4G-5WBF-YIQX-L57Y}\\REV_2807.cmd" /sc ONLOGON /RL HIGHEST /F2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\patch\krn.dllFilesize
625KB
MD5eccf28d7e5ccec24119b88edd160f8f4
SHA198509587a3d37a20b56b50fd57f823a1691a034c
SHA256820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
SHA512c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670
-
C:\patch\ntd2.dllFilesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
memory/1056-146-0x0000000000000000-mapping.dmp
-
memory/2736-138-0x0000000000400000-0x0000000001836000-memory.dmpFilesize
20.2MB
-
memory/2736-145-0x0000000066000000-0x000000006618C000-memory.dmpFilesize
1.5MB
-
memory/2736-137-0x0000000000400000-0x0000000001836000-memory.dmpFilesize
20.2MB
-
memory/2736-139-0x0000000066000000-0x000000006618C000-memory.dmpFilesize
1.5MB
-
memory/2736-140-0x0000000000400000-0x0000000001836000-memory.dmpFilesize
20.2MB
-
memory/2736-141-0x0000000000400000-0x0000000001836000-memory.dmpFilesize
20.2MB
-
memory/2736-144-0x0000000077DF0000-0x0000000077F93000-memory.dmpFilesize
1.6MB
-
memory/2736-155-0x0000000077DF0000-0x0000000077F93000-memory.dmpFilesize
1.6MB
-
memory/2736-136-0x0000000066000000-0x000000006618C000-memory.dmpFilesize
1.5MB
-
memory/2736-133-0x0000000066000000-0x000000006618C000-memory.dmpFilesize
1.5MB
-
memory/2736-131-0x0000000077DF0000-0x0000000077F93000-memory.dmpFilesize
1.6MB
-
memory/2736-130-0x0000000000400000-0x0000000001836000-memory.dmpFilesize
20.2MB
-
memory/2736-156-0x0000000066000000-0x000000006618C000-memory.dmpFilesize
1.5MB
-
memory/2736-154-0x0000000000400000-0x0000000001836000-memory.dmpFilesize
20.2MB
-
memory/3032-149-0x0000000000000000-mapping.dmp
-
memory/3032-153-0x0000000001000000-0x0000000002000000-memory.dmpFilesize
16.0MB
-
memory/3032-152-0x0000000001000000-0x0000000002000000-memory.dmpFilesize
16.0MB
-
memory/3032-150-0x0000000001000000-0x0000000002000000-memory.dmpFilesize
16.0MB
-
memory/3032-157-0x0000000077DF0000-0x0000000077F93000-memory.dmpFilesize
1.6MB
-
memory/3032-158-0x0000000001000000-0x0000000002000000-memory.dmpFilesize
16.0MB
-
memory/3032-159-0x0000000001000000-0x0000000002000000-memory.dmpFilesize
16.0MB
-
memory/3032-160-0x0000000001000000-0x0000000002000000-memory.dmpFilesize
16.0MB
-
memory/3032-161-0x0000000001001000-0x0000000001005000-memory.dmpFilesize
16KB
-
memory/3032-162-0x0000000001000000-0x0000000002000000-memory.dmpFilesize
16.0MB
-
memory/3032-163-0x0000000077DF0000-0x0000000077F93000-memory.dmpFilesize
1.6MB