4e45051d214af572935596233db47eee57ceb6600841815dc51171dee15840f5

Analysis

max time kernel
142s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/03/2023, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Clip1.exe
Size

3.4MB
MD5

7c3ba41716690f6d5bca3520700e894c
SHA1

d8112039a130dd3d406c8b2386cce5ef8a745ce0
SHA256

4e45051d214af572935596233db47eee57ceb6600841815dc51171dee15840f5
SHA512

a3f6251d657d7abd982d68252c5085fe0393384c3edb37c19a750afbe95adeb926d5586f54be4f3ea1b314b533bd0676de35f7bd22460f1c0cefc464c8cbf23b
SSDEEP

49152:rr1c7Kvf8e9HTgXHXayMSTQ5c1ztH9rDDQvOJRg05T0Oa/rm2ho8IucxzrurVlo9:gKvfd94XayMT5sH9M0aS8o9uWyUhHyk

Score

9^/10

discovery evasion trojan upx

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TemplatesTemplates-type2.6.0.1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TemplatesTemplates-type2.6.0.1.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TemplatesTemplates-type2.6.0.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TemplatesTemplates-type2.6.0.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TemplatesTemplates-type2.6.0.1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TemplatesTemplates-type2.6.0.1.exe

Executes dropped EXE 2 IoCs

pid	Process
664	TemplatesTemplates-type2.6.0.1.exe
1956	TemplatesTemplates-type2.6.0.1.exe

Loads dropped DLL 4 IoCs

pid	Process
1728	AppLaunch.exe
1728	AppLaunch.exe
1568	taskeng.exe
1568	taskeng.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1320	icacls.exe
1180	icacls.exe
1460	icacls.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000900000001232c-68.dat	upx
behavioral1/files/0x000900000001232c-73.dat	upx
behavioral1/files/0x000900000001232c-72.dat	upx
behavioral1/files/0x000900000001232c-69.dat	upx
behavioral1/files/0x000900000001232c-74.dat	upx
behavioral1/memory/664-75-0x000000013F970000-0x000000013FE8F000-memory.dmp	upx
behavioral1/memory/664-76-0x000000013F970000-0x000000013FE8F000-memory.dmp	upx
behavioral1/memory/664-79-0x000000013F970000-0x000000013FE8F000-memory.dmp	upx
behavioral1/memory/664-80-0x000000013F970000-0x000000013FE8F000-memory.dmp	upx
behavioral1/files/0x000900000001232c-81.dat	upx
behavioral1/files/0x000900000001232c-82.dat	upx
behavioral1/files/0x000900000001232c-83.dat	upx
behavioral1/memory/1956-87-0x000000013F740000-0x000000013FC5F000-memory.dmp	upx
behavioral1/memory/1956-86-0x000000013F740000-0x000000013FC5F000-memory.dmp	upx
behavioral1/memory/1956-85-0x000000013F740000-0x000000013FC5F000-memory.dmp	upx
behavioral1/memory/1956-88-0x000000013F740000-0x000000013FC5F000-memory.dmp	upx
behavioral1/memory/1956-89-0x000000013F740000-0x000000013FC5F000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TemplatesTemplates-type2.6.0.1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TemplatesTemplates-type2.6.0.1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 1728	2044	Clip1.exe	29

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1716	schtasks.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1728	2044	Clip1.exe	29
PID 2044 wrote to memory of 1728	2044	Clip1.exe	29
PID 2044 wrote to memory of 1728	2044	Clip1.exe	29
PID 2044 wrote to memory of 1728	2044	Clip1.exe	29
PID 2044 wrote to memory of 1728	2044	Clip1.exe	29
PID 2044 wrote to memory of 1728	2044	Clip1.exe	29
PID 2044 wrote to memory of 1728	2044	Clip1.exe	29
PID 2044 wrote to memory of 1728	2044	Clip1.exe	29
PID 2044 wrote to memory of 1728	2044	Clip1.exe	29
PID 1728 wrote to memory of 1320	1728	AppLaunch.exe	30
PID 1728 wrote to memory of 1320	1728	AppLaunch.exe	30
PID 1728 wrote to memory of 1320	1728	AppLaunch.exe	30
PID 1728 wrote to memory of 1320	1728	AppLaunch.exe	30
PID 1728 wrote to memory of 1320	1728	AppLaunch.exe	30
PID 1728 wrote to memory of 1320	1728	AppLaunch.exe	30
PID 1728 wrote to memory of 1320	1728	AppLaunch.exe	30
PID 1728 wrote to memory of 1180	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1180	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1180	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1180	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1180	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1180	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1180	1728	AppLaunch.exe	31
PID 1728 wrote to memory of 1460	1728	AppLaunch.exe	34
PID 1728 wrote to memory of 1460	1728	AppLaunch.exe	34
PID 1728 wrote to memory of 1460	1728	AppLaunch.exe	34
PID 1728 wrote to memory of 1460	1728	AppLaunch.exe	34
PID 1728 wrote to memory of 1460	1728	AppLaunch.exe	34
PID 1728 wrote to memory of 1460	1728	AppLaunch.exe	34
PID 1728 wrote to memory of 1460	1728	AppLaunch.exe	34
PID 1728 wrote to memory of 1716	1728	AppLaunch.exe	36
PID 1728 wrote to memory of 1716	1728	AppLaunch.exe	36
PID 1728 wrote to memory of 1716	1728	AppLaunch.exe	36
PID 1728 wrote to memory of 1716	1728	AppLaunch.exe	36
PID 1728 wrote to memory of 1716	1728	AppLaunch.exe	36
PID 1728 wrote to memory of 1716	1728	AppLaunch.exe	36
PID 1728 wrote to memory of 1716	1728	AppLaunch.exe	36
PID 1728 wrote to memory of 664	1728	AppLaunch.exe	38
PID 1728 wrote to memory of 664	1728	AppLaunch.exe	38
PID 1728 wrote to memory of 664	1728	AppLaunch.exe	38
PID 1728 wrote to memory of 664	1728	AppLaunch.exe	38
PID 1568 wrote to memory of 1956	1568	taskeng.exe	40
PID 1568 wrote to memory of 1956	1568	taskeng.exe	40
PID 1568 wrote to memory of 1956	1568	taskeng.exe	40

C:\Users\Admin\AppData\Local\Temp\Clip1.exe
"C:\Users\Admin\AppData\Local\Temp\Clip1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\ProgramData\TemplatesTemplates-type2.6.0.1" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
    3⤵
    - Modifies file permissions
    PID:1320
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\ProgramData\TemplatesTemplates-type2.6.0.1" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
    3⤵
    - Modifies file permissions
    PID:1180
- - C:\Windows\SysWOW64\icacls.exe
    "C:\Windows\System32\icacls.exe" "C:\ProgramData\TemplatesTemplates-type2.6.0.1" /inheritance:e /deny "admin:(R,REA,RA,RD)"
    3⤵
    - Modifies file permissions
    PID:1460
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /TN "TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1" /TR "C:\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe" /SC MINUTE
    3⤵
    - Creates scheduled task(s)
    PID:1716
- - C:\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe
    "C:\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    PID:664

C:\Windows\system32\taskeng.exe
taskeng.exe {6EBBD3DF-3593-4F23-A809-4CB9AE79AA71} S-1-5-21-3499517378-2376672570-1134980332-1000:MLXLFKOI\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568
- C:\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe
  C:\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe

Filesize
280.5MB

MD5
5d5f4b2e4d5ec9fa04d5670f5aff074b

SHA1
4b4895abd5a776116145c6a38ce1e823f0fbf649

SHA256
437a20b7e4e281657df618eafcfffe50dc31360d1f2ddbb6c3557d61e043c5c8

SHA512
28619b9ea75920b11c7f8c16b81b53b1dd1f685373db6dfdb5e81702f2236ea362ad64e6d8eda726f7e41927f0868a64bd934f5a9072f3fdceae225a4a2556eb

Download Submit
C:\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe

Filesize
313.9MB

MD5
97d1cff6606df19eea9901368c140cda

SHA1
280fb3c414e74f75657c3b7c37a2129f3ecbde5d

SHA256
153578e8c7326e6ed087d223f58bac608db18efccdaa3df9934f11169a4fe57c

SHA512
90f4e4732a5307acfbcd8e64da3ff52348b52b24595bbe514a75784660a83e01f1e4666605a5814a24db9f1e6053d28b77135bd7531888270c71ec5275f296b9

Download Submit
C:\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe

Filesize
299.5MB

MD5
079e738a1d5dd6437e330b47330f3358

SHA1
d361cba3052e19828cbc810e44a36aed99274326

SHA256
01b9241f6f3bed1d5b161a65e42ada3e9fe65307c98a94ffbf939a503d99b9ea

SHA512
2bbe05dc8d7ba0e472b459bf369bdbd5a163f438d2566e51828cd6e0e820f21a4629777f2f43df53594d9656ecb48e0deb4c214c40481a0d443727efd1473af6

Download Submit
C:\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe

Filesize
105.5MB

MD5
30731721226a7a9c676aa13abbfaae78

SHA1
3d09082f2ff35763dd76e3ff14d456a7c7c240b6

SHA256
9183eab7b7559ee00891526db12ee90dea06725caf84af386e711bc13e273bdf

SHA512
ae917a98bf801b3e975619ac3879cb33f86d7f7ef95bf39e75f58c1db878fea8e191150f60f093c73d988985cb1eac731c602598f47ab11eefc2a88a28cd36ea

Download Submit
\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe

Filesize
285.9MB

MD5
dd8c80346ec5e68798fe051f47389ac3

SHA1
c8641f8f91f550b4ef1394232038e3fcd263e950

SHA256
b3f35d7bf9469a9ac7824ca87973222d6f8a86ce94ab417078eab0b20c5c8471

SHA512
23a983420b186c630dd6086f3642348b0c596f8942f2890e301dd4cf9de93c8459c1368a01303e22c8d7d3cf0ed4ea69bef7be9c87f32388dd0446728f84c0dc

Download Submit
\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe

Filesize
296.2MB

MD5
dd61484655a0001e5a29370e696f3d00

SHA1
b960c8e78285c2ab8423f656fbd77792d47cf88f

SHA256
088ccc66f6617046b3d4cb15b123c3a6b5a418b73e6d22355283c4397ffccb1e

SHA512
a855c75dae4a3d87ca6cacc87a82e082bac733257a792ca3ad502b26942595fb6c6eafb018c54a59dced8570d460f6600fdfb68521d1b8e4b0162e908cf16e88

Download Submit
\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe

Filesize
109.7MB

MD5
1ae5237732ea2810941a4f87ee4cca6a

SHA1
f5f5eadcce18269a6934ba1357ac594fd359c4d1

SHA256
95cb9fa083e019e8a98630266a7f7f1868c605ad3a1cbd58c1f6fe3ba8ccd375

SHA512
e682530a5b17f7b78006db08b1982e9247028f2fe52ba638ac1a699334d5cd562b255ffb36e09e9a6bd58e0340521788937058b3bce81ddc1749e164a8b21e5c

Download Submit
\ProgramData\TemplatesTemplates-type2.6.0.1\TemplatesTemplates-type2.6.0.1.exe

Filesize
93.9MB

MD5
0e9c394795cce6bace5aa639de8ccbc2

SHA1
c701947ae4e35bcce7790e54608a407013837629

SHA256
ba9c22f1dcf8ff1efc78cbdd38819072c9a64291b8a002dc6b578ef26dc3a57b

SHA512
2cd2c0579efcc154985fcd3fbb88c3c3191dfc264f1e6098ba3332cd1e06639352ce4a5fa6fbcbf19efbaf461bf503127cb902ecdbc4f10eb0aa76954904eb39

Download Submit
memory/664-76-0x000000013F970000-0x000000013FE8F000-memory.dmp

Filesize
5.1MB

Download
memory/664-79-0x000000013F970000-0x000000013FE8F000-memory.dmp

Filesize
5.1MB

Download
memory/664-80-0x000000013F970000-0x000000013FE8F000-memory.dmp

Filesize
5.1MB

Download
memory/664-75-0x000000013F970000-0x000000013FE8F000-memory.dmp

Filesize
5.1MB

Download
memory/1568-84-0x000000013F740000-0x000000013FC5F000-memory.dmp

Filesize
5.1MB

Download
memory/1728-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1728-61-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/1728-77-0x0000000008160000-0x000000000867F000-memory.dmp

Filesize
5.1MB

Download
memory/1728-78-0x0000000008160000-0x000000000867F000-memory.dmp

Filesize
5.1MB

Download
memory/1728-65-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Filesize
256KB

Download
memory/1728-64-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Filesize
256KB

Download
memory/1728-54-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/1728-63-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Filesize
256KB

Download
memory/1728-62-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/1728-55-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/1956-87-0x000000013F740000-0x000000013FC5F000-memory.dmp

Filesize
5.1MB

Download
memory/1956-85-0x000000013F740000-0x000000013FC5F000-memory.dmp

Filesize
5.1MB

Download
memory/1956-86-0x000000013F740000-0x000000013FC5F000-memory.dmp

Filesize
5.1MB

Download
memory/1956-88-0x000000013F740000-0x000000013FC5F000-memory.dmp

Filesize
5.1MB

Download
memory/1956-89-0x000000013F740000-0x000000013FC5F000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads