Analysis
-
max time kernel
440s -
max time network
433s -
platform
windows10-1703_x64 -
resource
win10-20220901-es -
resource tags
-
submitted
08/02/2023, 13:03
General
-
Target
payload5.zip
-
Size
13.8MB
-
MD5
87e80bb294c14cbf60deda9992113859
-
SHA1
f4fce6ee5238e285e28be6f25f2689a10f93b2f5
-
SHA256
119185c921128618a213f5bd825df3a354bd802f6361972713e65fe2890a8a6c
-
SHA512
20a3f54f76b06a202d0f058f625fdb4a0ecc1456b9c3d8a470c6dabaef78cacebf523b64c8a41f7a151c0f6c6a6902e0bdfe378d3154045af01835148b3279ea
-
SSDEEP
393216:lK84AqkQMzYDEddNmhf92ZrkN0csbcUMpPdYq6MuNVB+t4OGrgi:Q84MHwEdP0ANkylbcHFYVSt43r7
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Themida packer 11 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\payload5.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\payload5\" -spe -an -ai#7zMap27482:74:7zEvent111541⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\payload5\a.exe"C:\Users\Admin\Desktop\payload5\a.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.8MB
MD5e2019c979c97d42176f92f46c598b6dc
SHA15739fe323f68fd84afe31c7d65b1f3e3347efca2
SHA256dcd9ed3211ca46b6182400f2d885e3e8e475dce38d3450890e009b5279f921d2
SHA5128c710b93b4e1587abb014cdf49d6c72b0357286eeb2673f754666a51dbd1ba66a61d419f2a8a8e96af6a2bcb26a24892a51441f9a1af7d5c69345d05b2ca3878
-
Filesize
196B
MD526e7415d38a6259e2c133786958c5bd3
SHA170b28c16b8d070f18f7643541d85f5c50569e1fd
SHA256741f9d4fe88deec4a8b9362468d55f76244d77c1d8e962b1a987f88f4b7cc61e
SHA512137c66136c361c85e1221d8b58c5cb6572ddada2fba227dffcbf67ec6bb98f44a80207a4e89526e5abd4445aeb9eb1cedfe1cf34f8d57677c872a24f3e533392
-
Filesize
889KB
MD503c469798bf1827d989f09f346ce95f7
SHA105e491bc1b8fbfbfdca24b565f2464137f30691e
SHA256de87c8713fac002b0b0a0f9b02c4e3ebcccf65282a22f5ab5912a9da00f35c2a
SHA512d95aed75dd7b2470d4e5052b4b494ad9efbb9eee42c63cf0b38f1d0275ff7b1bb8ee4cbc69d1bb219dbbf33ad3b01cea97f87fa8fe69be7f943aa4417a603238
-
Filesize
889KB
MD503c469798bf1827d989f09f346ce95f7
SHA105e491bc1b8fbfbfdca24b565f2464137f30691e
SHA256de87c8713fac002b0b0a0f9b02c4e3ebcccf65282a22f5ab5912a9da00f35c2a
SHA512d95aed75dd7b2470d4e5052b4b494ad9efbb9eee42c63cf0b38f1d0275ff7b1bb8ee4cbc69d1bb219dbbf33ad3b01cea97f87fa8fe69be7f943aa4417a603238
-
Filesize
8KB
MD5d8f4ab8284f0fda871d6834e24bc6f37
SHA1641948e44a1dcfd0ef68910768eb4b1ea6b49d10
SHA256c09d0790e550694350b94ca6b077c54f983c135fab8990df5a75462804150912
SHA512f65a916041846718306567d33273c3d0f41e0b26589cf6db46ec6c788ba0d87a708c94979d3bd0609142badca9e7129690b92169a07dcf7cd8c66698827d2fa0
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
37.1MB
-
Filesize
37.1MB
-
Filesize
37.1MB
-
Filesize
37.1MB
-
Filesize
37.1MB
-
Filesize
1.6MB
-
Filesize
37.1MB
-
Filesize
37.1MB
-
Filesize
37.1MB
-
Filesize
37.1MB
-
Filesize
37.1MB