Analysis
-
max time kernel
142s -
max time network
271s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/01/2024, 00:24
General
-
Target
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe
-
Size
2.9MB
-
MD5
713b1c97b09d0e633ede2f62556e78b9
-
SHA1
c67835ca9504049a350fdb023ec7975cccce1674
-
SHA256
c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0
-
SHA512
fadada8a709662a013a5b7984357d41fb004d3e600274ce2d067f081b246a6c8e764e104ff88c2131343d3a500a855ecd5990b968458d0bef5a1e5a15a99ee50
-
SSDEEP
49152:f9X3GwWO9gJdmbB6v6WELRkyVVgYgHUByjGw4JGP9zwYFHbXZkigd8ljRs1pit:f9pWO96dEu6WCQUBF1CdyiPsW
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe"C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 12482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1184 -ip 11841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD55f54d1240735d46980b776af554f44d3
SHA1acf7707c08973ddfdb27cd361442ccfba355c888
SHA2562c80619d7e7c58257293cda3a878c13e5856f4e06f6f90601276f7b9179c9e07
SHA512b1f542f68a48608ae53904fbe2105bd8f3e544941abb38ec9d24cb7a26f916ef94cfb431cce0c64077dc2934913130d78492914a5e9ffc52f311e68217caef15
-
Filesize
575B
MD561c324611e6b2e1b180664f7a7982a7e
SHA12fd5af80cbe4c805edc71f1d29fd442eabf7109f
SHA256cfac38a276ea508da50703915692cb8bd9d734ce74dc051239beb68cf89b2b37
SHA5127ec1f946f8f659994899c6b8c9b2e6af61d763882dc419e3e18bf98b5884cfdae16e09c27d308ae022df51ec1ed2e3e9b38e970c94c473669f702c33b4876378
-
Filesize
7.5MB
-
Filesize
8KB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB