Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 10:32

General

  • Target

    176cd7a571f2cf2a5daecd58bb8c52b6.exe

  • Size

    604KB

  • MD5

    176cd7a571f2cf2a5daecd58bb8c52b6

  • SHA1

    ca635e4a3a36fb5cb265d0676059a3e7fe61074b

  • SHA256

    1505d45bcc9b30ef7d23f0eae1d473730dc2467941f125b63d7453d3886db767

  • SHA512

    69149574bacbc42108d5e1815dc19189ad0d05b5d4a30a2a68084a90765bb334cfe45fc399466e500d305a358a964b1b9d04670d1da0bb8a289cfaa2bcddae7b

  • SSDEEP

    12288:lqmSXl3v5iqGWvSOEZIJo333nEHYdpSYzcHwYm0h/pBWGXAO6rwT2Os9eNvjAdB:lXSXl3v5fv38naHYqVSZO6rwds9cvjAb

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\176cd7a571f2cf2a5daecd58bb8c52b6.exe
    "C:\Users\Admin\AppData\Local\Temp\176cd7a571f2cf2a5daecd58bb8c52b6.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Users\Admin\AppData\Local\Temp\n3320\s3320.exe
      "C:\Users\Admin\AppData\Local\Temp\n3320\s3320.exe" 5136d026e9f800fcf8f41b0037qdVFrrSokkGR99U+/rnEuOx2L2Np8DyN0IqKnwx7HyrmJ9kYGGhWuTDyTSLMKv4vR69J4amy/Btyi5ADt+nN3i/Ga/B+EA/haKy+7FtnsT7aGt7G0fKeMowZ6i2E+m/laov7Ve3iHrViWe5fMWkRD+ /v "C:\Users\Admin\AppData\Local\Temp\176cd7a571f2cf2a5daecd58bb8c52b6.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ab720a0c4d0e6ab0b112d3d6c74033d1

    SHA1

    8fd4caee12bc39b911d4fdc6f30eb3c71832eeed

    SHA256

    f17d3d0bb4bc8ac9bad5fc80d0e1c45ec66abb5d94e04914b38d5b97857e9135

    SHA512

    b414731266db19072799004e0c1091df9b26e6b2e5d174f6fc0e462b294e3e3a29d28e554670a5be7f92eda2a3e4d8ce002859ca3e99365a51a8b17fbbd8c98d

  • C:\Users\Admin\AppData\Local\Temp\Cab6192.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar61F3.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • \Users\Admin\AppData\Local\Temp\n3320\s3320.exe

    Filesize

    229KB

    MD5

    c7a6d01a847a39c88efbe79e2bacd95d

    SHA1

    4422c5334f100c4f214bbc8dddb1ce6f39f962d3

    SHA256

    e0fdf7b5c67e9b22593b277b0c4e2fb03e667a1932c322f1d5cd3432fc48af29

    SHA512

    eb5acaa7da130783e1c8acf6583371edac6e4a263219ef9cb38ad6dc90a26b4d8d41542553565fa2f0e41c1c7e348fec934121233ea56bc94362f1c7544d1a6c

  • memory/2096-4-0x0000000000980000-0x0000000000990000-memory.dmp

    Filesize

    64KB

  • memory/2096-129-0x00000000001E0000-0x000000000027D000-memory.dmp

    Filesize

    628KB

  • memory/2096-2-0x00000000001E0000-0x000000000027D000-memory.dmp

    Filesize

    628KB

  • memory/2288-120-0x0000000001E50000-0x0000000001ED0000-memory.dmp

    Filesize

    512KB

  • memory/2288-118-0x0000000000330000-0x0000000000342000-memory.dmp

    Filesize

    72KB

  • memory/2288-119-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2288-25-0x0000000001E50000-0x0000000001ED0000-memory.dmp

    Filesize

    512KB

  • memory/2288-121-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2288-122-0x0000000001E50000-0x0000000001ED0000-memory.dmp

    Filesize

    512KB

  • memory/2288-123-0x0000000001E50000-0x0000000001ED0000-memory.dmp

    Filesize

    512KB

  • memory/2288-124-0x0000000001E50000-0x0000000001ED0000-memory.dmp

    Filesize

    512KB

  • memory/2288-125-0x0000000001E50000-0x0000000001ED0000-memory.dmp

    Filesize

    512KB

  • memory/2288-126-0x0000000001E50000-0x0000000001ED0000-memory.dmp

    Filesize

    512KB

  • memory/2288-127-0x0000000001E50000-0x0000000001ED0000-memory.dmp

    Filesize

    512KB

  • memory/2288-128-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

    Filesize

    9.6MB

  • memory/2288-24-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

    Filesize

    9.6MB