Analysis

  • max time kernel
    147s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 00:34

General

  • Target

    1d49c5cc618392e58460b89f5cb12038.exe

  • Size

    1.7MB

  • MD5

    1d49c5cc618392e58460b89f5cb12038

  • SHA1

    fcc1af1a11f50d93f7500493b3fe19084afa7db2

  • SHA256

    22888b18b66d99463b3b96a478f73e0cad82f495717f8ba509c3c58177474f95

  • SHA512

    e265a47b7aafcead8af9b43c5975b6e2ba62f95098afc1b80a3a4b1eb2e3bddb6c8980741608bab2ff6ed451dc2d26e76d9199f0b3fdc32020dcd63e394832a5

  • SSDEEP

    24576:TJI7H8wlhEodBPziRQkl5m95xNybvdj7FoGp6Bcash2uskeGadbj8ymx+ifPkSuz:SPxH0Mpkdj7KBcc7hjZmHUQlmCo

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 1 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d49c5cc618392e58460b89f5cb12038.exe
    "C:\Users\Admin\AppData\Local\Temp\1d49c5cc618392e58460b89f5cb12038.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Checks for VirtualBox DLLs, possible anti-VM trick
    PID:3508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsz45C4.tmp\setup.dll

    Filesize

    385KB

    MD5

    7b3515a43a6257cf3909a0eee16c4550

    SHA1

    8104008c80b1790c8d6051cb05ca1e8663d93c7b

    SHA256

    ea7f0ccc98c97662550342ba42a9e1815f25f522ef001cb8b03a915abf8235ea

    SHA512

    5a1827915b94b445fc2e6e8c5f53715610439ce1a4031e85207d7e1854e077354977b7e1b307e159ec6f08d810d6c0513eeb5e0cf526bf25e9602a54b7d6886f

  • C:\Users\Admin\AppData\Local\Temp\nsz45C4.tmp\setup.dll

    Filesize

    381KB

    MD5

    f6a34e1626afbfae9c833ac8cc3cc193

    SHA1

    9dadccebae502c2f0e07b9c9f19080e44586ccd8

    SHA256

    4d4be340f0824daeda6457d284de2ddb69d60da2548282c8e09555440cab0fc1

    SHA512

    f4d692e007a3c86828a1706e42223790b1026e563976520ecc64c07cfecf3da0a190a4fc2aefa0dc509c9bf0dbeb912c4818e17a95caeba1ab008b47f84dd656

  • memory/3508-14-0x0000000010000000-0x00000000101EE000-memory.dmp

    Filesize

    1.9MB

  • memory/3508-9-0x0000000010000000-0x00000000101EE000-memory.dmp

    Filesize

    1.9MB

  • memory/3508-7-0x0000000010000000-0x00000000101EE000-memory.dmp

    Filesize

    1.9MB

  • memory/3508-13-0x0000000010000000-0x00000000101EE000-memory.dmp

    Filesize

    1.9MB

  • memory/3508-8-0x0000000002C00000-0x0000000002DEB000-memory.dmp

    Filesize

    1.9MB

  • memory/3508-6-0x00000000023C0000-0x00000000023C3000-memory.dmp

    Filesize

    12KB

  • memory/3508-11-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB

  • memory/3508-12-0x0000000010000000-0x00000000101EE000-memory.dmp

    Filesize

    1.9MB

  • memory/3508-16-0x0000000010000000-0x00000000101EE000-memory.dmp

    Filesize

    1.9MB

  • memory/3508-15-0x0000000010000000-0x00000000101EE000-memory.dmp

    Filesize

    1.9MB

  • memory/3508-21-0x0000000010000000-0x00000000101EE000-memory.dmp

    Filesize

    1.9MB

  • memory/3508-32-0x0000000010000000-0x00000000101EE000-memory.dmp

    Filesize

    1.9MB

  • memory/3508-33-0x0000000010000000-0x00000000101D3000-memory.dmp

    Filesize

    1.8MB

  • memory/3508-34-0x00000000023C0000-0x00000000023C3000-memory.dmp

    Filesize

    12KB

  • memory/3508-36-0x00000000025C0000-0x00000000025C1000-memory.dmp

    Filesize

    4KB