Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
09-11-2023 23:46
Static task
static1
Behavioral task
behavioral1
Sample
609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe
Resource
win10v2004-20231023-en
General
-
Target
609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe
-
Size
2.9MB
-
MD5
e137bb9179a46870abb745b6fb0af8c9
-
SHA1
b453de02538a6ec30b245dc2e2049a24aae6da56
-
SHA256
609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe
-
SHA512
5dae62605d4ea9ab802b7efd16e2dad074fb1704e74b39564187d7b7736804fc3b4b02890f80d80ae226d48e3d07c4dc363e0af3b8fa683457f9dd4706c2b20e
-
SSDEEP
49152:I4/BQx8MYqkA7L/Hn5T/Lj/dW6tMyMpy7El0deUiAKqsXmQcoTCym5dz8eO:I2g8HDA7LJ/dBPWG/3PKxcem5dz8e
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe -
Modifies registry class 5 IoCs
Processes:
609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDE0A32F-FA40-78A7-45D2-C0A815638054}\InProcServer32 609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDE0A32F-FA40-78A7-45D2-C0A815638054}\InProcServer32\ = "C:\\Windows\\SysWOW64\\Windows.Devices.Enumeration.dll" 609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDE0A32F-FA40-78A7-45D2-C0A815638054}\InProcServer32\ThreadingModel = "Both" 609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDE0A32F-FA40-78A7-45D2-C0A815638054} 609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDE0A32F-FA40-78A7-45D2-C0A815638054}\ = "DevicePairingActivationPlugin" 609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exedescription pid process Token: 33 2248 609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe Token: SeIncBasePriorityPrivilege 2248 609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exepid process 2248 609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe"C:\Users\Admin\AppData\Local\Temp\609085596def8972c4a3a0618425c5c415f51846e55bb507f395d1a390c35abe.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2248