Overview
overview
9Static
static
7Appfuscate...or.exe
windows7-x64
9Appfuscate...or.exe
windows10-2004-x64
9Appfuscate...ib.dll
windows7-x64
1Appfuscate...ib.dll
windows10-2004-x64
1Appfuscate...db.dll
windows7-x64
1Appfuscate...db.dll
windows10-2004-x64
1Appfuscate...db.dll
windows7-x64
1Appfuscate...db.dll
windows10-2004-x64
1Appfuscate...ks.dll
windows7-x64
1Appfuscate...ks.dll
windows10-2004-x64
1Appfuscate...il.dll
windows7-x64
1Appfuscate...il.dll
windows10-2004-x64
1Appfuscate...on.dll
windows7-x64
1Appfuscate...on.dll
windows10-2004-x64
1Appfuscate...er.exe
windows7-x64
1Appfuscate...er.exe
windows10-2004-x64
1Appfuscate...er.exe
windows7-x64
1Appfuscate...er.exe
windows10-2004-x64
1Appfuscate...00.exe
windows7-x64
7Appfuscate...00.exe
windows10-2004-x64
7Analysis
-
max time kernel
28s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-06-2023 15:41
Behavioral task
behavioral1
Sample
Appfuscated - Cracked by Voxguard/AppFuscator.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Appfuscated - Cracked by Voxguard/AppFuscator.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Appfuscated - Cracked by Voxguard/ICSharpCode.SharpZipLib.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Appfuscated - Cracked by Voxguard/ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Mdb.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Mdb.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Pdb.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Pdb.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Rocks.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Rocks.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Appfuscated - Cracked by Voxguard/Newtonsoft.Json.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Appfuscated - Cracked by Voxguard/Newtonsoft.Json.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
Appfuscated - Cracked by Voxguard/StackTraceDecoder.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Appfuscated - Cracked by Voxguard/StackTraceDecoder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Appfuscated - Cracked by Voxguard/WatermarkDecoder.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Appfuscated - Cracked by Voxguard/WatermarkDecoder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Appfuscated - Cracked by Voxguard/unins000.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Appfuscated - Cracked by Voxguard/unins000.exe
Resource
win10v2004-20230220-en
General
-
Target
Appfuscated - Cracked by Voxguard/unins000.exe
-
Size
2.5MB
-
MD5
61859891f371ac2ce1c892f3baae796b
-
SHA1
26cfd62d65cb12608d0ac5d56b2d4b7b8045c591
-
SHA256
c6dd4365001767875e9a9e61c90baeee1ac5726301105018237b30f9028a196e
-
SHA512
d059d84eb280ac8c64db3d276a35e5995ce9349a739668fe34be2056b0962112343fa43a2fa146cb05d8a65515b6065a7f96839c3a19fcccb2a59edeadcc9c0e
-
SSDEEP
49152:1R/KpmZubPf2S8W2ILeWl+C1p9jWy5Snd0eigXNa:b/jtYLP1Sy5E0p
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1184 _iu14D2N.tmp -
Executes dropped EXE 1 IoCs
pid Process 1184 _iu14D2N.tmp -
Loads dropped DLL 1 IoCs
pid Process 1240 unins000.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1184 _iu14D2N.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1240 wrote to memory of 1184 1240 unins000.exe 27 PID 1240 wrote to memory of 1184 1240 unins000.exe 27 PID 1240 wrote to memory of 1184 1240 unins000.exe 27 PID 1240 wrote to memory of 1184 1240 unins000.exe 27 PID 1240 wrote to memory of 1184 1240 unins000.exe 27 PID 1240 wrote to memory of 1184 1240 unins000.exe 27 PID 1240 wrote to memory of 1184 1240 unins000.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\Appfuscated - Cracked by Voxguard\unins000.exe"C:\Users\Admin\AppData\Local\Temp\Appfuscated - Cracked by Voxguard\unins000.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\Appfuscated - Cracked by Voxguard\unins000.exe" /FIRSTPHASEWND=$D01502⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1184
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD561859891f371ac2ce1c892f3baae796b
SHA126cfd62d65cb12608d0ac5d56b2d4b7b8045c591
SHA256c6dd4365001767875e9a9e61c90baeee1ac5726301105018237b30f9028a196e
SHA512d059d84eb280ac8c64db3d276a35e5995ce9349a739668fe34be2056b0962112343fa43a2fa146cb05d8a65515b6065a7f96839c3a19fcccb2a59edeadcc9c0e
-
Filesize
2.5MB
MD561859891f371ac2ce1c892f3baae796b
SHA126cfd62d65cb12608d0ac5d56b2d4b7b8045c591
SHA256c6dd4365001767875e9a9e61c90baeee1ac5726301105018237b30f9028a196e
SHA512d059d84eb280ac8c64db3d276a35e5995ce9349a739668fe34be2056b0962112343fa43a2fa146cb05d8a65515b6065a7f96839c3a19fcccb2a59edeadcc9c0e
-
Filesize
2.5MB
MD561859891f371ac2ce1c892f3baae796b
SHA126cfd62d65cb12608d0ac5d56b2d4b7b8045c591
SHA256c6dd4365001767875e9a9e61c90baeee1ac5726301105018237b30f9028a196e
SHA512d059d84eb280ac8c64db3d276a35e5995ce9349a739668fe34be2056b0962112343fa43a2fa146cb05d8a65515b6065a7f96839c3a19fcccb2a59edeadcc9c0e