Analysis
-
max time kernel
85s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
08-08-2022 11:45
General
-
Target
9c7e29c721b9524b371ff62ebf92d4e38abbd2a3c5d05715e2add153aed4c221.exe
-
Size
4.8MB
-
MD5
4fc82b5e28a7265ee93c3e7c5ea6de8b
-
SHA1
fc24012a44abaeea5c7fcf3c67da7c480ab6b7ce
-
SHA256
9c7e29c721b9524b371ff62ebf92d4e38abbd2a3c5d05715e2add153aed4c221
-
SHA512
8b7d2d2d6bdcf5404d17196c124c615cc3283b3d4ea1d6ebc4dd7ad294667e39b3202fc538ed74f70561d6983ac3d9e9c8a09967d250b59eaf13de38285c3a76
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 11 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c7e29c721b9524b371ff62ebf92d4e38abbd2a3c5d05715e2add153aed4c221.exe"C:\Users\Admin\AppData\Local\Temp\9c7e29c721b9524b371ff62ebf92d4e38abbd2a3c5d05715e2add153aed4c221.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
1.6MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
1.6MB
-
Filesize
12.0MB