Analysis
-
max time kernel
118s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
08-10-2023 07:55
General
-
Target
c1210bfa51de1eecc994cdfd73eac8222a3b7fb6e7fb68b98921fe99f6f2fd79.exe
-
Size
6.2MB
-
MD5
44964176a36d913c78fdcf6570ca10b5
-
SHA1
c919e9b8779aa15465250adc386a80308d47fa11
-
SHA256
c1210bfa51de1eecc994cdfd73eac8222a3b7fb6e7fb68b98921fe99f6f2fd79
-
SHA512
c5a6b85001b4a4c351579f15be9892d77fb32ca7684ad01dc2f249a902f16dc912fd4224a982152e48e91b0b2922d0cae4a55021e7a8dd942b2e75a293c497e2
-
SSDEEP
98304:kRiC10wxNleXTQwBA8aK9dmMZNBrpcFrPVyAEdjtw8TLhMhndN:/A0wET1AHKvmIrpctxEbfq
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1210bfa51de1eecc994cdfd73eac8222a3b7fb6e7fb68b98921fe99f6f2fd79.exe"C:\Users\Admin\AppData\Local\Temp\c1210bfa51de1eecc994cdfd73eac8222a3b7fb6e7fb68b98921fe99f6f2fd79.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
-
Filesize
6.3MB
-
Filesize
68KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB