Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2023 02:11
Static task
static1
General
-
Target
2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed.exe
-
Size
3.4MB
-
MD5
2fa49cce2716beaa8747f80a1ff23a5f
-
SHA1
63cafe83dfbd6dfae9f5d5796e9c49faa7f26259
-
SHA256
2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed
-
SHA512
b50530ebd1def720da9090deec61e086c8cf73b3919ab3aad3cf1290fb65922655c8a0ea67e5a6ccaec5178431e667bc9d70b35925b9dd52ce29a65726402d61
-
SSDEEP
49152:lr1c7Kvf8e9HTgXHXayMSTQ5c1ztH9rDDQvOJRg05T0Oa/rm2ho8IucxzrurVlon:+Kvfd94XayMT5sH9M0aS8o9uWyUhHy+
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
Templatesssh-type0.4.9.7.exeTemplatesssh-type0.4.9.7.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Templatesssh-type0.4.9.7.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Templatesssh-type0.4.9.7.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Templatesssh-type0.4.9.7.exeTemplatesssh-type0.4.9.7.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Templatesssh-type0.4.9.7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Templatesssh-type0.4.9.7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Templatesssh-type0.4.9.7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Templatesssh-type0.4.9.7.exe -
Executes dropped EXE 2 IoCs
Processes:
Templatesssh-type0.4.9.7.exeTemplatesssh-type0.4.9.7.exepid process 4788 Templatesssh-type0.4.9.7.exe 4028 Templatesssh-type0.4.9.7.exe -
Modifies file permissions 1 TTPs 3 IoCs
Processes:
icacls.exeicacls.exeicacls.exepid process 2644 icacls.exe 2212 icacls.exe 4408 icacls.exe -
Processes:
resource yara_rule C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exe upx C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exe upx C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exe upx behavioral1/memory/4788-153-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmp upx behavioral1/memory/4788-152-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmp upx behavioral1/memory/4788-154-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmp upx behavioral1/memory/4788-155-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmp upx C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exe upx behavioral1/memory/4028-157-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmp upx behavioral1/memory/4028-158-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmp upx behavioral1/memory/4028-159-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmp upx -
Processes:
Templatesssh-type0.4.9.7.exeTemplatesssh-type0.4.9.7.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Templatesssh-type0.4.9.7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Templatesssh-type0.4.9.7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed.exedescription pid process target process PID 4816 set thread context of 364 4816 2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed.exe AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed.exeAppLaunch.exedescription pid process target process PID 4816 wrote to memory of 364 4816 2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed.exe AppLaunch.exe PID 4816 wrote to memory of 364 4816 2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed.exe AppLaunch.exe PID 4816 wrote to memory of 364 4816 2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed.exe AppLaunch.exe PID 4816 wrote to memory of 364 4816 2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed.exe AppLaunch.exe PID 4816 wrote to memory of 364 4816 2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed.exe AppLaunch.exe PID 364 wrote to memory of 2644 364 AppLaunch.exe icacls.exe PID 364 wrote to memory of 2644 364 AppLaunch.exe icacls.exe PID 364 wrote to memory of 2644 364 AppLaunch.exe icacls.exe PID 364 wrote to memory of 2212 364 AppLaunch.exe icacls.exe PID 364 wrote to memory of 2212 364 AppLaunch.exe icacls.exe PID 364 wrote to memory of 2212 364 AppLaunch.exe icacls.exe PID 364 wrote to memory of 4408 364 AppLaunch.exe icacls.exe PID 364 wrote to memory of 4408 364 AppLaunch.exe icacls.exe PID 364 wrote to memory of 4408 364 AppLaunch.exe icacls.exe PID 364 wrote to memory of 4004 364 AppLaunch.exe schtasks.exe PID 364 wrote to memory of 4004 364 AppLaunch.exe schtasks.exe PID 364 wrote to memory of 4004 364 AppLaunch.exe schtasks.exe PID 364 wrote to memory of 4788 364 AppLaunch.exe Templatesssh-type0.4.9.7.exe PID 364 wrote to memory of 4788 364 AppLaunch.exe Templatesssh-type0.4.9.7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed.exe"C:\Users\Admin\AppData\Local\Temp\2f1daf41d17043e9b479e306c5d7467d62d2da473fee1d1781fbde4e415114ed.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\Templatesssh-type0.4.9.7" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\Templatesssh-type0.4.9.7" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\Templatesssh-type0.4.9.7" /inheritance:e /deny "admin:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7" /TR "C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exe" /SC MINUTE3⤵
- Creates scheduled task(s)
-
C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exe"C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exeC:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exeFilesize
675.7MB
MD556b334c425f0a111cb9e2c2873ac4250
SHA1a299b5dc9459c3dd412ea69ea021efaaa4009d4f
SHA25674997e4df7f595e94ddaac76a9c66ccb4af2fa41d54cd93cd61ab0e1b6c76c4e
SHA51257615c58549f6f4a333ee98f30cc1c41b70490a00f49191ac470b18923b63a29e9e1272f27fa5ea2f5d3c07e59c63e3c93802cb4229b4abcc51832f6e2113aec
-
C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exeFilesize
683.6MB
MD5111a21944f4dfb1991bdd75ebfd45d60
SHA1e6ddabdca95c2b04447954f48afbda420817066a
SHA256daf5d538ec932539a55f499f2d481d1f3b19a6d23e8c2d5a8ed31f25c73ed153
SHA512bdc60234e7f0b67a66cb751beaa22b0e5ab838d0fddc859535c927e2c2d79ba8459ab66d72daf81742adfa68cba4b21a7339c69874a3d2a375840ab034fba87b
-
C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exeFilesize
666.4MB
MD5e902de9f83e8394e1ebf8a78f7b32a97
SHA100d76bd9e5b3a11d43ac60d896e1cafbf0e37dda
SHA2566fa92a7f9b37805f4eef263a37c6cc2c98f82c8eaaaa3cea1471f1e3f42842a0
SHA5125920ebfe1fe2668bfd2df4ee789f713eb7e58049bd397f059c388c5a1aa9fdced2dbc98f0d43b97c755df7a0bebb6d5b7d88eafb89cda3c5ded122d2585e70b1
-
C:\ProgramData\Templatesssh-type0.4.9.7\Templatesssh-type0.4.9.7.exeFilesize
193.6MB
MD50beabedaaf445d37ffbac96daaf8dc2f
SHA1e0ec8ee211c08f768aff9288e7dbc292f40979a8
SHA2568de583d535fd4cd6b2875eb0c24290d03d1766b0744ea4d347d647d83afc147a
SHA51211eeb990f3214bbf5f46df52143fafa34faafdff35589051a004963f0cdffdaf50595b6159d0668f34fd0b810dbbb1651ba8d7405f7a41d55570380be912ffd7
-
memory/364-141-0x0000000005250000-0x0000000005260000-memory.dmpFilesize
64KB
-
memory/364-142-0x0000000005250000-0x0000000005260000-memory.dmpFilesize
64KB
-
memory/364-133-0x0000000000720000-0x0000000000A7C000-memory.dmpFilesize
3.4MB
-
memory/364-140-0x0000000005190000-0x000000000519A000-memory.dmpFilesize
40KB
-
memory/364-139-0x0000000004FF0000-0x0000000005082000-memory.dmpFilesize
584KB
-
memory/364-138-0x0000000005500000-0x0000000005AA4000-memory.dmpFilesize
5.6MB
-
memory/4028-157-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmpFilesize
5.1MB
-
memory/4028-158-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmpFilesize
5.1MB
-
memory/4028-159-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmpFilesize
5.1MB
-
memory/4788-153-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmpFilesize
5.1MB
-
memory/4788-152-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmpFilesize
5.1MB
-
memory/4788-154-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmpFilesize
5.1MB
-
memory/4788-155-0x00007FF7CFCB0000-0x00007FF7D01CF000-memory.dmpFilesize
5.1MB