Analysis
-
max time kernel
151s -
max time network
99s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
14-06-2023 15:41
General
-
Target
Appfuscated - Cracked by Voxguard/AppFuscator.exe
-
Size
5.6MB
-
MD5
d19985c8b4de4a0cef2f5a4533140ca4
-
SHA1
4fb1de3c3aebc888aec868a7d921ad6653e6aba4
-
SHA256
1d0638e1f906f41b6dcb34a685223eb6b1b19874661a2131dcbe9c76e1ec1791
-
SHA512
2eaf25002f57ffc2ece5c68bdf17182b393dceee0b836cb6d9d4c2ab7604b9b2e2dc47da1e9c6499fc341a23130c14dfbadd51530a11ae1e73c37ca1c4d3ba4d
-
SSDEEP
98304:EIvuNN/N91h2eDZQjL7sU8I5DKBWoClkRGJewd8Y3evBQ9LtYVrEx3/o6ETgKbWt:ET9GeDVI5DKBWZlkgJedYs6LtYdEhqTp
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Appfuscated - Cracked by Voxguard\AppFuscator.exe"C:\Users\Admin\AppData\Local\Temp\Appfuscated - Cracked by Voxguard\AppFuscator.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
Filesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
1.2MB
-
Filesize
208KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB