Analysis
-
max time kernel
25s -
max time network
31s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
06-01-2024 14:14
General
-
Target
Setup.exe
-
Size
6.8MB
-
MD5
f0f01fb9ad7ecab5d698da5679175f29
-
SHA1
314198b1a6cf81cd3b64a91f4eab5ad881ecff2c
-
SHA256
5f1c46da9e266b1f7f31953e593636c6b0e1968636e81e62e820122bfa40706f
-
SHA512
c67c093543bd7ef126801dd6e42a6864471dede82d35bdf9c2c508d63af9d0effd6ca312c37bc1261925ba027d4162543ce5267eb93eb5d14abf6d2b89fabf9c
-
SSDEEP
196608:+/Qr1IjiQrQg+2JraSvJ4NQ7Esnoy8aX8v:V1GiQrQ7HSvJRzoy8aXw
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
17.1MB
-
Filesize
2.0MB
-
Filesize
17.1MB