Analysis
-
max time kernel
61s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08/05/2023, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
9496629c92a2e39342e92ebb495615c6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9496629c92a2e39342e92ebb495615c6.exe
Resource
win10v2004-20230220-en
General
-
Target
9496629c92a2e39342e92ebb495615c6.exe
-
Size
604KB
-
MD5
9496629c92a2e39342e92ebb495615c6
-
SHA1
13f99e13b95f949260c254545cee88cea39e991d
-
SHA256
cbd3e106e4397133983cbd43f8f7f3d9b9957a12c7fe8c65a936490a3b62d212
-
SHA512
c933a5c2679bef2048381e5574c33f9917a80a252839e3160aabdb98a62f61b17d40687ac6b2b7635e8caba643048c5791fb37c9979b23ec652d8c3cc3315dea
-
SSDEEP
12288:e/fEu+Hdsy7MfSu9xoF3bUnY6yNijq0XL:uEu+HdsAMqu9xoEygjq07
Malware Config
Signatures
-
Enumerates VirtualBox DLL files 2 TTPs 10 IoCs
description ioc Process File opened (read-only) C:\windows\System32\vboxdisp.dll 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\vboxhook.dll 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\vboxoglarrayspu.dll 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\vboxoglpackspu.dll 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\vboxoglpassthroughspu.dll 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\vboxmrxnp.dll 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\vboxogl.dll 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\vboxoglcrutil.dll 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\vboxoglerrorspu.dll 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\vboxoglfeedbackspu.dll 9496629c92a2e39342e92ebb495615c6.exe -
Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs
description ioc Process File opened (read-only) C:\windows\System32\drivers\VBoxMouse.sys 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\drivers\VBoxGuest.sys 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\drivers\VBoxSF.sys 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\drivers\VBoxVideo.sys 9496629c92a2e39342e92ebb495615c6.exe -
Looks for VirtualBox executables on disk 2 TTPs 3 IoCs
description ioc Process File opened (read-only) C:\windows\System32\vboxservice.exe 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\vboxtray.exe 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\windows\System32\VBoxControl.exe 9496629c92a2e39342e92ebb495615c6.exe -
Looks for VMWare drivers on disk 2 TTPs 4 IoCs
description ioc Process File opened (read-only) C:\windows\System32\drivers\Vmmouse.sys 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\Windows\System32\drivers\vmhgfs.sys 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\Windows\System32\drivers\vmmemctl.sys 9496629c92a2e39342e92ebb495615c6.exe File opened (read-only) C:\Windows\System32\drivers\vmmouse.sys 9496629c92a2e39342e92ebb495615c6.exe -
Executes dropped EXE 1 IoCs
pid Process 1180 embedded.exe -
Loads dropped DLL 3 IoCs
pid Process 836 cmd.exe 836 cmd.exe 2036 iexplore.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Sun Java Security Plugin = "C:\\Users\\Admin\\AppData\\Roaming\\Java Security Plugin\\javaplugin.exe" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sun Java Security Plugin = "C:\\Users\\Admin\\AppData\\Roaming\\Java Security Plugin\\javaplugin.exe" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 832 wrote to memory of 836 832 9496629c92a2e39342e92ebb495615c6.exe 29 PID 832 wrote to memory of 836 832 9496629c92a2e39342e92ebb495615c6.exe 29 PID 832 wrote to memory of 836 832 9496629c92a2e39342e92ebb495615c6.exe 29 PID 832 wrote to memory of 836 832 9496629c92a2e39342e92ebb495615c6.exe 29 PID 836 wrote to memory of 1180 836 cmd.exe 30 PID 836 wrote to memory of 1180 836 cmd.exe 30 PID 836 wrote to memory of 1180 836 cmd.exe 30 PID 836 wrote to memory of 1180 836 cmd.exe 30 PID 1180 wrote to memory of 2036 1180 embedded.exe 31 PID 1180 wrote to memory of 2036 1180 embedded.exe 31 PID 1180 wrote to memory of 2036 1180 embedded.exe 31 PID 1180 wrote to memory of 2036 1180 embedded.exe 31 PID 1180 wrote to memory of 2036 1180 embedded.exe 31 PID 2036 wrote to memory of 680 2036 iexplore.exe 32 PID 2036 wrote to memory of 680 2036 iexplore.exe 32 PID 2036 wrote to memory of 680 2036 iexplore.exe 32 PID 2036 wrote to memory of 680 2036 iexplore.exe 32 PID 2036 wrote to memory of 680 2036 iexplore.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\9496629c92a2e39342e92ebb495615c6.exe"C:\Users\Admin\AppData\Local\Temp\9496629c92a2e39342e92ebb495615c6.exe"1⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Looks for VirtualBox executables on disk
- Looks for VMWare drivers on disk
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c embedded.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\embedded.exeembedded.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵PID:680
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5140d24af0c2b3a18529df12dfbc5f6de
SHA1e8db5ad2b7ffede3e41b9c3adb24f3232d764931
SHA2564eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92
SHA512a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415
-
Filesize
66KB
MD5140d24af0c2b3a18529df12dfbc5f6de
SHA1e8db5ad2b7ffede3e41b9c3adb24f3232d764931
SHA2564eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92
SHA512a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415
-
Filesize
48KB
MD5b5f429729f6ba45df4fc03b7b07a1fb8
SHA10f93258b587c8f1955de1138f0c08290e65c06df
SHA256e41fb7878c89cc728005f3c82f7ee8c14ce27edcf4e307ddd8691f62dd5e6726
SHA512e54fca413ac9ca30b03ba49d5b060473bd8158bd68afb867dd7309618d23add8a480eced723e042e206b58b663d852d993999c5023dcb440263ed143442ad3be
-
Filesize
66KB
MD5140d24af0c2b3a18529df12dfbc5f6de
SHA1e8db5ad2b7ffede3e41b9c3adb24f3232d764931
SHA2564eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92
SHA512a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415
-
Filesize
66KB
MD5140d24af0c2b3a18529df12dfbc5f6de
SHA1e8db5ad2b7ffede3e41b9c3adb24f3232d764931
SHA2564eabb1adc035f035e010c0d0d259c683e18193f509946652ed8aa7c5d92b6a92
SHA512a2ead649f155555ec3e55800494f833d18cea68afe736807ec23b5991242928a0853e451b60894ec8e0abe8c42db341c2237007981f38f0366fd7c6ecafb7415