Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
14/06/2023, 15:34
General
-
Target
Appfuscator Crack V2/AppFuscator.exe
-
Size
6.4MB
-
MD5
069bc1539b09eb79536cee398d67383f
-
SHA1
7145e990c38bb3520c2b1424757bcaad710801f9
-
SHA256
5e5d5817a92b59969f7ff4d60ed9e0f0da2a834878ef68d2e222b7548dbcd02d
-
SHA512
5bba9859040fe888c6b8a3b5ecaef666ed941d9dcb655743339787f6c4e726eb835f8ed552c66d6c97086fcc58ae90c59b4f6d3dac400c652a8bc3cbeb9726e6
-
SSDEEP
196608:SaBMZGIC9GeDVI5DKBWZlkgJedYs6LtYdEhqTgKD:3BuGNkYVI5DK2NNs6LtYdEhSp
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Appfuscator Crack V2\AppFuscator.exe"C:\Users\Admin\AppData\Local\Temp\Appfuscator Crack V2\AppFuscator.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
Filesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
1.3MB
-
Filesize
208KB
-
Filesize
6.4MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB