Overview

overview

9

Static

static

7

cc17a2ff14...8c.exe

windows7-x64

9

cc17a2ff14...8c.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    19s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-03-2023 14:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe

  • Size

    3.4MB

  • MD5

    1dcfb969cf87e2e4cb9bb4a56e750e15

  • SHA1

    c0d398d156582131a4dca76bdb85cf6e3342d68c

  • SHA256

    cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c

  • SHA512

    f6b9bed8db1012566c80dec02471a6af4a052bf62361f0a51432340960b7cc5b776b384458a47aa462b3f6fa1fd507c0d05f1b5d74216402447d9dfa25771b5b

  • SSDEEP

    49152:Mvcs1F4p7LFsNqzfQX6mqDHLvtf2YyAqRZEI/1Tag5rTIluaYdfPKrpjJwebZVTL:MPFUz1DHdgBd26TrPsV2gTgikq

Score
9/10
evasionpersistencethemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 24 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • AutoIT Executable 22 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe
    "C:\Users\Admin\AppData\Local\Temp\cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Windows\SysWOW64\WSCript.exe
      WSCript C:\Users\Admin\AppData\Local\Temp\RYMTSF.vbs
      2⤵
        PID:1328

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Virtualization/Sandbox Evasion

    1
    T1497

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Virtualization/Sandbox Evasion

    1
    T1497

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RYMTSF.vbs
      Filesize

      948B

      MD5

      57401e5fd7f02d0a5dd8739c55df638e

      SHA1

      67edbf6ca8960d1c1f05e0fa33500a711d01b0be

      SHA256

      de367bde6d9ddd5c8b3a66d273e3d7a229b50b01b0297a5336171c25c20a82a5

      SHA512

      8cecf8309184551275880294cd5b1f4739f505e334718fc4601ebf4cda6f79847de23db7112540f563e51bf4644b83362d235b63f7fdc0bb2aef51d8d59c8b08

      Download Submit
    • memory/1804-147-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-157-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-136-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-137-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-138-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-139-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-140-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-141-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-134-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-145-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-159-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-135-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-150-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-149-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-148-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-151-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-152-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-153-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-154-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-155-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-156-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-133-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-158-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download
    • memory/1804-146-0x0000000000BA0000-0x000000000138E000-memory.dmp
      Filesize

      7.9MB

      Download