Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11/10/2023, 20:46
General
-
Target
948b76208d5d744db1ec9d5806be87c7.exe
-
Size
4.2MB
-
MD5
948b76208d5d744db1ec9d5806be87c7
-
SHA1
44b2e73646f19c048d18b6a44c991a4cade77f93
-
SHA256
80cd52c06b28feaadc19750e498c6dd8f1440fba457ec08010c25e7a2ced13ff
-
SHA512
bc19d3fd2638e7a679386386b81c18d657f0c44a7ac61a6d6c7b391c35d54f90f6e48c141c65e2fbc3040a1ba3fad1c78a1b2a4fc88b80f3781a622891d3738d
-
SSDEEP
98304:S/CnviB8mf2gF+uuUckft2a+SLgFCVx0u1JbQxd7XSOqY:RvUdfTFlL7LgFAyu1JbqddqY
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\948b76208d5d744db1ec9d5806be87c7.exe"C:\Users\Admin\AppData\Local\Temp\948b76208d5d744db1ec9d5806be87c7.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.5MB
-
Filesize
2.8MB
-
Filesize
11.5MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
11.5MB
-
Filesize
10.8MB
-
Filesize
11.5MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.8MB
-
Filesize
11.5MB
-
Filesize
10.8MB