Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
13-11-2023 03:42
General
-
Target
kernel-injection.exe
-
Size
3.6MB
-
MD5
2000ee7b472fa0bed9fd3bdf661b4613
-
SHA1
8fdcf7bcc86c8bab9b3f19b1eee01ebea6d4d84d
-
SHA256
18543bcf137afd15dac41bb3b0666aac04fa24c3215a3464e22392d2097a10df
-
SHA512
fbf75dafaef38787a268a32e2254dc9fd2a7db06064eb052fbc10c71a7e3991078e9255e6e9ced914fc522d41a6efdc6f4d750074456dd60101738fd65c09f29
-
SSDEEP
98304:311rtCZ6BCeMEhm0yC0J+QDNDALuGnpd0VcQ:31Z4ZACeMbJ+Q5Kvcx
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\kernel-injection.exe"C:\Users\Admin\AppData\Local\Temp\kernel-injection.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 92⤵
-
-
C:\Windows\SoftwareDistribution\Download\fgV9n.exe"C:\Windows\SoftwareDistribution\Download\fgV9n.exe"2⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD59886a738e05f8a8fe04e9d0c81cc0909
SHA1f659c6a123eb11f6f34f618265dbd54a9aa7f5e3
SHA256abf99bd1d851c4c7015b999e81fb080e7e1147973e6a3a77c8ba7895cc8abbb6
SHA5120d3b9e9a1a38efe1e963b929a33a8a13d4636d8056ab04fce958333db983b9fb401946c9b6990d18e9c2e2d4c2dbd2fb6aae5385e4234a5d86ef8adb98d56a21
-
Filesize
100KB
MD59886a738e05f8a8fe04e9d0c81cc0909
SHA1f659c6a123eb11f6f34f618265dbd54a9aa7f5e3
SHA256abf99bd1d851c4c7015b999e81fb080e7e1147973e6a3a77c8ba7895cc8abbb6
SHA5120d3b9e9a1a38efe1e963b929a33a8a13d4636d8056ab04fce958333db983b9fb401946c9b6990d18e9c2e2d4c2dbd2fb6aae5385e4234a5d86ef8adb98d56a21
-
Filesize
100KB
MD59886a738e05f8a8fe04e9d0c81cc0909
SHA1f659c6a123eb11f6f34f618265dbd54a9aa7f5e3
SHA256abf99bd1d851c4c7015b999e81fb080e7e1147973e6a3a77c8ba7895cc8abbb6
SHA5120d3b9e9a1a38efe1e963b929a33a8a13d4636d8056ab04fce958333db983b9fb401946c9b6990d18e9c2e2d4c2dbd2fb6aae5385e4234a5d86ef8adb98d56a21
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
2.0MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
2.0MB