Analysis
-
max time kernel
70s -
max time network
73s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
13-03-2023 19:24
Behavioral task
behavioral1
Sample
Hidden Malware Builder V5.0/H-Malware Builder V5.exe
Resource
win7-20230220-en
General
-
Target
Hidden Malware Builder V5.0/H-Malware Builder V5.exe
-
Size
3.6MB
-
MD5
57376dc58b364f2282afbbddcb8dd192
-
SHA1
e028e7293e55ea12dad74b7d42c687a9f450afeb
-
SHA256
76ec12ac2cbab7a0bea9b656afbc469c53a6948a18c783a5d99a92263274ff70
-
SHA512
ca06edcfff15a2b45a2c8d5bf5b76d38ff727e5cea34783c2ec4c1988f6b0c7dd492d9bbb6a5f1cf15fdd9120c72a66c1b34b8b6a3efba8066aec4f7a45a39c0
-
SSDEEP
49152:bhRhbyC5mXd6cy0uc4SgcsEEcv02+sazXIOUDa+mC5R6QsKsi3tX/aguTvCBCuir:pTXVhc50vsqALt50QsK5uyi4/g
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
H-Malware Builder V5.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ H-Malware Builder V5.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
H-Malware Builder V5.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion H-Malware Builder V5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion H-Malware Builder V5.exe -
Processes:
resource yara_rule behavioral1/memory/2004-57-0x0000000000C70000-0x00000000015B2000-memory.dmp themida behavioral1/memory/2004-59-0x0000000000C70000-0x00000000015B2000-memory.dmp themida -
Processes:
H-Malware Builder V5.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA H-Malware Builder V5.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
H-Malware Builder V5.exepid process 2004 H-Malware Builder V5.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc458990000000002000000000010660000000100002000000096c32764a20a0a52ced02240c77eba8b48cf791b9f5592cc46fd0d780654e4ee000000000e8000000002000020000000570f79bef1207181a661839a8400f928a1992dfab30898a6af24691835f045cb90000000ac25bcf86636dd7f028dcb55ff5bb5cd5dc1175a8ee14a394043fa5dfddea48c8192ad1e786fd8b36b990200ebb035a96bb92f663b717fb5edefdb09204709603c941a4dfb57bed54b23764ac59c7dc5eca6531715e8f5cdaf8a8f0a9a684791bc1452172c2f9edef13b64349575c811d36ea2e989e680c01da5c2277507e4d681e416c9725afb9ad1513538b7a6429c4000000088dde86dea4ec87b13c007d56b4be3e3b205f4a6a5d043deee81831b95f3d993ff4a743f0fd5c969821e40962dc43e7b21479d036a53908b7dc2be8edd35eec6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc458990000000002000000000010660000000100002000000071e60ba6c4b03a0450fadfc52c9bda70d1620fedf2a74073c4df85b435aee6ae000000000e8000000002000020000000d4b7efa581985158456d2f3a0f8db81e4369c05a784c26c6f265893d9853301820000000ff5db996d0a752a586e4e5cefb09e2c3fc47f6f41d797760aeeeccf8b43919a840000000ee854cdf7a3afcf02ccd7b809676a83fb582781744c29e2b8b16145a021f1ac8cbcd546e27f600b9d5c0f47d82ea2877cb9f47d0fd5a7936e8ca14662bb60aab iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F190AD1-C1DD-11ED-A9BE-F2E58DC6BB35} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "385504046" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100ee4ece955d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1956 iexplore.exe 1956 iexplore.exe 588 IEXPLORE.EXE 588 IEXPLORE.EXE 588 IEXPLORE.EXE 588 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
H-Malware Builder V5.exeiexplore.exedescription pid process target process PID 2004 wrote to memory of 1956 2004 H-Malware Builder V5.exe iexplore.exe PID 2004 wrote to memory of 1956 2004 H-Malware Builder V5.exe iexplore.exe PID 2004 wrote to memory of 1956 2004 H-Malware Builder V5.exe iexplore.exe PID 2004 wrote to memory of 1956 2004 H-Malware Builder V5.exe iexplore.exe PID 1956 wrote to memory of 588 1956 iexplore.exe IEXPLORE.EXE PID 1956 wrote to memory of 588 1956 iexplore.exe IEXPLORE.EXE PID 1956 wrote to memory of 588 1956 iexplore.exe IEXPLORE.EXE PID 1956 wrote to memory of 588 1956 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hidden Malware Builder V5.0\H-Malware Builder V5.exe"C:\Users\Admin\AppData\Local\Temp\Hidden Malware Builder V5.0\H-Malware Builder V5.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=H-Malware Builder V5.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.02⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5ccdec3b90993d2a888983bb5ceef2ea0
SHA1c4ea62af4c9cdca34dd4880634d916488568caba
SHA2560f877317e497c85c9f8f5ba03de58bff90bb5cb084ba3a2019f90fa0b0fcce08
SHA5122a64fe4e7e69ed45c987fe6f540199765ee6f6f02a6b938efaefb7ce3cd4d74241bfc23591926e301ecda341c32d75a084966ff7f47b9ccb6b21edcc41ac40eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5ac161b2ce2d617c0765e153cda16af2e
SHA17a9635326081420c03e3d7d0e8ea5716e45b28d9
SHA2564b41849368cef1101f633e21bc8b49fe12cefdb1f3e504c92ce476486ff5142b
SHA512db487b4bcc69876cbdbfe4d29f467dfeb1b80ab13ced707382374cd18728994242ba149f3629b0cc63a13f4c3872d690b4d52d69677a795e27c88819ad249153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD595afd051cb2f02fb8223a8698355079b
SHA12854373491fba96d25e7f9f9d92a4a4cadb0fe0b
SHA2569530ecc6c969aa57961c3f8006dbdbb88039a2dae450f7fed107348d5e5ac129
SHA5124259c8771a6865f5d491a14c6eaf0bb33cd9077472cd5527e986dddcc8eea640e30df26e099cb2cc965a1a30cf14c11ebaae06e09fdb926c86206a32bf698257
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD59a2017ef48d9495e9f8e2760a98e4c4c
SHA1a5dfae4980b692473d5f50989b63b410d57641f2
SHA2565e4b161041c4ca247d010648d419f8ac194cc0860653ab9557db03f5b1b66f1f
SHA512a4214314f44a52edca6564ca0cc48930d85973c5dfa23ead34041bd107a4e115103770047ab7c3419d2db5e133146826bcf0ad37631a083e3893454760145809
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5debc2681f12e68147128fb8742f11329
SHA15ed44d40a82cac33a71e11a18ee5883f6c1323e7
SHA2563fc39c5f66e68fed4270f5d3c48feb08d48bf890f147e1294f4dba8e832f9e1e
SHA51271ced3fd454df6af9e927fbee3ac75d5713773e62415d5f7586f1751ef0ed46a2bf6f160bf8cc8b0d9fd72c5b026f38e46b8cad8d3bd36c26354813f1c0e3e80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5f3ec2fed5056900bb587904850d79a92
SHA10639c7dc57910b2e76260d417156597fb9bc7252
SHA25647a88669d97e998831bb743a4233f000529ee33a0f7babd7c00fa6b9b60daae6
SHA512a3254265ec22abeced792ac132e5b02b15134a06ac4cab17a6a961d9f022697bab17be24223ef8e6a44e2e419fca49fab1a430fdd1c2f8f32c3c44de928d4c52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5aed3f03d50d85ea3ed8d6d9c6ee8090e
SHA1cf149001330e631b64af3a3ef90a9f04353bd41d
SHA2564a618a61fc69cce3be4f3ba19e7a1057da5395f17ba29810a6cd6c77dc6623e3
SHA5122fe565daf825d89152b072198c50b32ab2bdc40d7dfdfcecd5120d491c00a3b681656cdb5a6a0c93b7bb0771827e55ca45ce0104c98d2096b68ef396658c68db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD567824ec366cf708e1cefece8a124c6d7
SHA14f58e9185e4ad11dfd9360cba5753a6613e6c071
SHA2569ff18542c8ca775272ee14b867f0b7c7fd02697e3b349156d98f2bf167fd1dac
SHA512cb4838ffce4f054dd8af5461fccb2738502b68a518d40be708530669a39b52b80a08fb5b3773872d63e3184ca6d9e58dbaf04a15d376cc2af79701e10b726488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD52389abf123939eb870ff701c8228221f
SHA1a48b54f30fbb37ec43b64acfa4dfbe0e2c040dcb
SHA256b00d8dc1f74c8e08a0bea0845ad81dbf43b92a6b782eb7be230de29882fff8a6
SHA5124d3ab17f13a81af3eef30f6a868526dd2552a453ba818e4750f57b61dde07422c7e087379c3d9f2afbce11141ea96e47731da77a99c1a71660863b2e32f467d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5f6318c8131c0f0b2ef0446c7247c7e8a
SHA1cecc9b9129787d1b3766a908b8dbdf3531015251
SHA256f1d2a4de6b11325ccd4d823f564faa960d1f1a37df03ce35a7f8aa0956f5e639
SHA51233b74d052f6878693a8cc33d51a1c82099587af015f8632d86a2db3cd988fc8109919efd81d71e3b6e1443f2cadb4af2d8309b759c30cc36b250d99d48da7a07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
304B
MD5e6f4deedf1bb52be9732ae25c4e6715e
SHA1c4ce2d39e052017a347caa21f5c61afef5c2eef5
SHA2568775ab533115e93e1c01634b9553c7cd8e64348bfa7436e4b60836b261dd0af4
SHA512403dab4f24eb8ddfd9c566beb50f57d8916da547cfdc800ea0d70451e6f4b63f690c0ac23cfd088ada550d17d21a865691f12511b3f9f0367c019fdce2ea92e9
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\Tar2FFE.tmpFilesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XY5SS124.txtFilesize
607B
MD58d5e70473fbdb2cecc1b25cc01263ed6
SHA1c43aacb8602959cc5afd78aedadf5842a23e3561
SHA2562f9cad1d109fa7ae1ac7e436a1402c1709a651d22a44831682ebd0de6b458187
SHA512e90262fcc886d37db9daa6cc9af8bf7c493949847ca5b0ca0af163f35b1699ef630c09591495c2211965d0f3a164df9f4a58535d5e04cd0b16e9d0ff65690225
-
memory/2004-59-0x0000000000C70000-0x00000000015B2000-memory.dmpFilesize
9.3MB
-
memory/2004-57-0x0000000000C70000-0x00000000015B2000-memory.dmpFilesize
9.3MB