Resubmissions

11-06-2024 07:51

240611-jpzcdszarb 9

01-02-2024 21:15

240201-z35z4aecd8 9

Analysis

  • max time kernel
    92s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2024 21:15

General

  • Target

    c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe

  • Size

    2.9MB

  • MD5

    713b1c97b09d0e633ede2f62556e78b9

  • SHA1

    c67835ca9504049a350fdb023ec7975cccce1674

  • SHA256

    c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0

  • SHA512

    fadada8a709662a013a5b7984357d41fb004d3e600274ce2d067f081b246a6c8e764e104ff88c2131343d3a500a855ecd5990b968458d0bef5a1e5a15a99ee50

  • SSDEEP

    49152:f9X3GwWO9gJdmbB6v6WELRkyVVgYgHUByjGw4JGP9zwYFHbXZkigd8ljRs1pit:f9pWO96dEu6WCQUBF1CdyiPsW

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 11 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe
    "C:\Users\Admin\AppData\Local\Temp\c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4660
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 984
      2⤵
      • Program crash
      PID:1732
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4660 -ip 4660
    1⤵
      PID:2780

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3073191680-435865314-2862784915-1000\desktop.ini
      Filesize

      129B

      MD5

      5f54d1240735d46980b776af554f44d3

      SHA1

      acf7707c08973ddfdb27cd361442ccfba355c888

      SHA256

      2c80619d7e7c58257293cda3a878c13e5856f4e06f6f90601276f7b9179c9e07

      SHA512

      b1f542f68a48608ae53904fbe2105bd8f3e544941abb38ec9d24cb7a26f916ef94cfb431cce0c64077dc2934913130d78492914a5e9ffc52f311e68217caef15

    • C:\Users\Admin\Videos\CBhwKBgQD.README.txt
      Filesize

      575B

      MD5

      61c324611e6b2e1b180664f7a7982a7e

      SHA1

      2fd5af80cbe4c805edc71f1d29fd442eabf7109f

      SHA256

      cfac38a276ea508da50703915692cb8bd9d734ce74dc051239beb68cf89b2b37

      SHA512

      7ec1f946f8f659994899c6b8c9b2e6af61d763882dc419e3e18bf98b5884cfdae16e09c27d308ae022df51ec1ed2e3e9b38e970c94c473669f702c33b4876378

    • memory/4660-3-0x0000000000EF0000-0x0000000001666000-memory.dmp
      Filesize

      7.5MB

    • memory/4660-0-0x0000000000EF0000-0x0000000001666000-memory.dmp
      Filesize

      7.5MB

    • memory/4660-4-0x0000000000EF0000-0x0000000001666000-memory.dmp
      Filesize

      7.5MB

    • memory/4660-5-0x0000000000EF0000-0x0000000001666000-memory.dmp
      Filesize

      7.5MB

    • memory/4660-6-0x0000000000EF0000-0x0000000001666000-memory.dmp
      Filesize

      7.5MB

    • memory/4660-7-0x0000000000EF0000-0x0000000001666000-memory.dmp
      Filesize

      7.5MB

    • memory/4660-8-0x0000000000EF0000-0x0000000001666000-memory.dmp
      Filesize

      7.5MB

    • memory/4660-2-0x0000000000EF0000-0x0000000001666000-memory.dmp
      Filesize

      7.5MB

    • memory/4660-1-0x0000000077AA4000-0x0000000077AA6000-memory.dmp
      Filesize

      8KB

    • memory/4660-573-0x0000000000EF0000-0x0000000001666000-memory.dmp
      Filesize

      7.5MB

    • memory/4660-1408-0x0000000000EF0000-0x0000000001666000-memory.dmp
      Filesize

      7.5MB

    • memory/4660-1409-0x0000000000EF0000-0x0000000001666000-memory.dmp
      Filesize

      7.5MB