Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 05:28
Static task
static1
General
-
Target
36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exe
-
Size
3.4MB
-
MD5
9383f0739c9ec8fa2f115488b6149b00
-
SHA1
f7de0fe9da6b48295c6233f081d3647209ab266f
-
SHA256
36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6
-
SHA512
4e84f36d05b5e8fbfcf2ee5616ee6af85fee56a8ccacce088bfbf4ef97467f8d52e027f0e8e77776443843c9ebd658e00608659d305321ca5c0350736db94a83
-
SSDEEP
98304:7JuR21C/yIq/dhl/O4i/TksjdFwvhzjMSwRVq:78D/yIqlhlW4i/QsnwZzjMSeVq
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
DesktopDesktop-type9.5.1.4.exeDesktopDesktop-type9.5.1.4.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ DesktopDesktop-type9.5.1.4.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ DesktopDesktop-type9.5.1.4.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
DesktopDesktop-type9.5.1.4.exeDesktopDesktop-type9.5.1.4.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DesktopDesktop-type9.5.1.4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DesktopDesktop-type9.5.1.4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DesktopDesktop-type9.5.1.4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DesktopDesktop-type9.5.1.4.exe -
Executes dropped EXE 2 IoCs
Processes:
DesktopDesktop-type9.5.1.4.exeDesktopDesktop-type9.5.1.4.exepid process 3836 DesktopDesktop-type9.5.1.4.exe 1252 DesktopDesktop-type9.5.1.4.exe -
Modifies file permissions 1 TTPs 3 IoCs
Processes:
icacls.exeicacls.exeicacls.exepid process 3316 icacls.exe 2856 icacls.exe 2792 icacls.exe -
Processes:
resource yara_rule C:\ProgramData\DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4.exe upx C:\ProgramData\DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4.exe upx behavioral1/memory/3836-149-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmp upx behavioral1/memory/3836-150-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmp upx behavioral1/memory/3836-151-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmp upx behavioral1/memory/3836-153-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmp upx C:\ProgramData\DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4.exe upx behavioral1/memory/1252-156-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmp upx behavioral1/memory/1252-157-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmp upx behavioral1/memory/1252-158-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmp upx behavioral1/memory/1252-159-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmp upx behavioral1/memory/1252-160-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmp upx -
Processes:
DesktopDesktop-type9.5.1.4.exeDesktopDesktop-type9.5.1.4.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DesktopDesktop-type9.5.1.4.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DesktopDesktop-type9.5.1.4.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exedescription pid process target process PID 1804 set thread context of 3976 1804 36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 428 1804 WerFault.exe 36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exeAppLaunch.exedescription pid process target process PID 1804 wrote to memory of 3976 1804 36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exe AppLaunch.exe PID 1804 wrote to memory of 3976 1804 36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exe AppLaunch.exe PID 1804 wrote to memory of 3976 1804 36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exe AppLaunch.exe PID 1804 wrote to memory of 3976 1804 36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exe AppLaunch.exe PID 1804 wrote to memory of 3976 1804 36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exe AppLaunch.exe PID 3976 wrote to memory of 2792 3976 AppLaunch.exe icacls.exe PID 3976 wrote to memory of 2792 3976 AppLaunch.exe icacls.exe PID 3976 wrote to memory of 2792 3976 AppLaunch.exe icacls.exe PID 3976 wrote to memory of 2856 3976 AppLaunch.exe icacls.exe PID 3976 wrote to memory of 2856 3976 AppLaunch.exe icacls.exe PID 3976 wrote to memory of 2856 3976 AppLaunch.exe icacls.exe PID 3976 wrote to memory of 3316 3976 AppLaunch.exe icacls.exe PID 3976 wrote to memory of 3316 3976 AppLaunch.exe icacls.exe PID 3976 wrote to memory of 3316 3976 AppLaunch.exe icacls.exe PID 3976 wrote to memory of 1580 3976 AppLaunch.exe schtasks.exe PID 3976 wrote to memory of 1580 3976 AppLaunch.exe schtasks.exe PID 3976 wrote to memory of 1580 3976 AppLaunch.exe schtasks.exe PID 3976 wrote to memory of 3836 3976 AppLaunch.exe DesktopDesktop-type9.5.1.4.exe PID 3976 wrote to memory of 3836 3976 AppLaunch.exe DesktopDesktop-type9.5.1.4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exe"C:\Users\Admin\AppData\Local\Temp\36bb0deef2c5cf1217b7a181118dfd622422113672b4bd4327b2bed1bba752f6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\DesktopDesktop-type9.5.1.4" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\DesktopDesktop-type9.5.1.4" /inheritance:e /deny "admin:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\DesktopDesktop-type9.5.1.4" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4" /TR "C:\ProgramData\DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4.exe" /SC MINUTE3⤵
- Creates scheduled task(s)
-
C:\ProgramData\DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4.exe"C:\ProgramData\DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 3962⤵
- Program crash
-
C:\ProgramData\DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4.exeC:\ProgramData\DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4.exeFilesize
697.4MB
MD5422e4e35465e3c7a652a6f58a97bdf59
SHA1675a84a0019a7f88ff5716b89eaa3b2151360283
SHA2567c41b15ed8fc6cca19079134e61ea44daf7875f9ad54ce9b50bfdde9df2bec6f
SHA512747ff7b93e635f33acbb7783c04c182e9a6a23856f7f53c23fe87a03ae2683ded8e63c8883ea0a73067885cfb8fc8b55f6c78118b3f50e056e9a2422addfed42
-
C:\ProgramData\DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4.exeFilesize
697.4MB
MD5422e4e35465e3c7a652a6f58a97bdf59
SHA1675a84a0019a7f88ff5716b89eaa3b2151360283
SHA2567c41b15ed8fc6cca19079134e61ea44daf7875f9ad54ce9b50bfdde9df2bec6f
SHA512747ff7b93e635f33acbb7783c04c182e9a6a23856f7f53c23fe87a03ae2683ded8e63c8883ea0a73067885cfb8fc8b55f6c78118b3f50e056e9a2422addfed42
-
C:\ProgramData\DesktopDesktop-type9.5.1.4\DesktopDesktop-type9.5.1.4.exeFilesize
555.7MB
MD5cb99be6b08a97919c29ffdc9a101adeb
SHA195920b94183e1eb95c7ac8360b21e75d73819b96
SHA256024806bbbdec45f99db011178019c358af685c67d64e464848245c6df6f0c3e8
SHA51284c2720576ab7acb922f1368cfa6934d979f3e2d8a7b6181ad14dcd3d5b9cf9d0ea78b076ef099af14d77222807a66b19e9400753749b56991b3c6c1c75046ae
-
memory/1252-160-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmpFilesize
5.1MB
-
memory/1252-159-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmpFilesize
5.1MB
-
memory/1252-158-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmpFilesize
5.1MB
-
memory/1252-157-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmpFilesize
5.1MB
-
memory/1252-156-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmpFilesize
5.1MB
-
memory/3836-153-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmpFilesize
5.1MB
-
memory/3836-149-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmpFilesize
5.1MB
-
memory/3836-150-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmpFilesize
5.1MB
-
memory/3836-151-0x00007FF7B6D30000-0x00007FF7B724F000-memory.dmpFilesize
5.1MB
-
memory/3976-120-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/3976-132-0x00000000092A0000-0x00000000092B0000-memory.dmpFilesize
64KB
-
memory/3976-131-0x00000000092A0000-0x00000000092B0000-memory.dmpFilesize
64KB
-
memory/3976-130-0x00000000092A0000-0x00000000092B0000-memory.dmpFilesize
64KB
-
memory/3976-129-0x0000000009250000-0x000000000925A000-memory.dmpFilesize
40KB
-
memory/3976-128-0x00000000092C0000-0x0000000009352000-memory.dmpFilesize
584KB
-
memory/3976-127-0x0000000009720000-0x0000000009C1E000-memory.dmpFilesize
5.0MB