Overview
overview
9Static
static
7Appfuscate...or.exe
windows7-x64
9Appfuscate...or.exe
windows10-2004-x64
9Appfuscate...ib.dll
windows7-x64
1Appfuscate...ib.dll
windows10-2004-x64
1Appfuscate...db.dll
windows7-x64
1Appfuscate...db.dll
windows10-2004-x64
1Appfuscate...db.dll
windows7-x64
1Appfuscate...db.dll
windows10-2004-x64
1Appfuscate...ks.dll
windows7-x64
1Appfuscate...ks.dll
windows10-2004-x64
1Appfuscate...il.dll
windows7-x64
1Appfuscate...il.dll
windows10-2004-x64
1Appfuscate...on.dll
windows7-x64
1Appfuscate...on.dll
windows10-2004-x64
1Appfuscate...er.exe
windows7-x64
1Appfuscate...er.exe
windows10-2004-x64
1Appfuscate...er.exe
windows7-x64
1Appfuscate...er.exe
windows10-2004-x64
1Appfuscate...00.exe
windows7-x64
7Appfuscate...00.exe
windows10-2004-x64
7Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2023 15:41
Behavioral task
behavioral1
Sample
Appfuscated - Cracked by Voxguard/AppFuscator.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Appfuscated - Cracked by Voxguard/AppFuscator.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Appfuscated - Cracked by Voxguard/ICSharpCode.SharpZipLib.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Appfuscated - Cracked by Voxguard/ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Mdb.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Mdb.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral7
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Pdb.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Pdb.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Rocks.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.Rocks.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Appfuscated - Cracked by Voxguard/Mono.Cecil.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Appfuscated - Cracked by Voxguard/Newtonsoft.Json.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Appfuscated - Cracked by Voxguard/Newtonsoft.Json.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
Appfuscated - Cracked by Voxguard/StackTraceDecoder.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Appfuscated - Cracked by Voxguard/StackTraceDecoder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Appfuscated - Cracked by Voxguard/WatermarkDecoder.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Appfuscated - Cracked by Voxguard/WatermarkDecoder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Appfuscated - Cracked by Voxguard/unins000.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Appfuscated - Cracked by Voxguard/unins000.exe
Resource
win10v2004-20230220-en
General
-
Target
Appfuscated - Cracked by Voxguard/unins000.exe
-
Size
2.5MB
-
MD5
61859891f371ac2ce1c892f3baae796b
-
SHA1
26cfd62d65cb12608d0ac5d56b2d4b7b8045c591
-
SHA256
c6dd4365001767875e9a9e61c90baeee1ac5726301105018237b30f9028a196e
-
SHA512
d059d84eb280ac8c64db3d276a35e5995ce9349a739668fe34be2056b0962112343fa43a2fa146cb05d8a65515b6065a7f96839c3a19fcccb2a59edeadcc9c0e
-
SSDEEP
49152:1R/KpmZubPf2S8W2ILeWl+C1p9jWy5Snd0eigXNa:b/jtYLP1Sy5E0p
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3944 _iu14D2N.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3944 _iu14D2N.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2704 wrote to memory of 3944 2704 unins000.exe 85 PID 2704 wrote to memory of 3944 2704 unins000.exe 85 PID 2704 wrote to memory of 3944 2704 unins000.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Appfuscated - Cracked by Voxguard\unins000.exe"C:\Users\Admin\AppData\Local\Temp\Appfuscated - Cracked by Voxguard\unins000.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Users\Admin\AppData\Local\Temp\Appfuscated - Cracked by Voxguard\unins000.exe" /FIRSTPHASEWND=$401102⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3944
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD561859891f371ac2ce1c892f3baae796b
SHA126cfd62d65cb12608d0ac5d56b2d4b7b8045c591
SHA256c6dd4365001767875e9a9e61c90baeee1ac5726301105018237b30f9028a196e
SHA512d059d84eb280ac8c64db3d276a35e5995ce9349a739668fe34be2056b0962112343fa43a2fa146cb05d8a65515b6065a7f96839c3a19fcccb2a59edeadcc9c0e
-
Filesize
2.5MB
MD561859891f371ac2ce1c892f3baae796b
SHA126cfd62d65cb12608d0ac5d56b2d4b7b8045c591
SHA256c6dd4365001767875e9a9e61c90baeee1ac5726301105018237b30f9028a196e
SHA512d059d84eb280ac8c64db3d276a35e5995ce9349a739668fe34be2056b0962112343fa43a2fa146cb05d8a65515b6065a7f96839c3a19fcccb2a59edeadcc9c0e