1fdba79d48422a0afff6293ca76d765dd0c7b3fc90f808f692971bf570af29d6

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

visualboyadvance-m.exe
Size

34.8MB
MD5

de97544187cf51538922174168fe92f7
SHA1

aad08dd1153443b4ed17ddb4c614bdabc6133bf3
SHA256

1fdba79d48422a0afff6293ca76d765dd0c7b3fc90f808f692971bf570af29d6
SHA512

34184b4a680f2a12b1c8f0e0178ec57c2dce253c895732abdde87da3098e610d9f213860a7ee286922a4848b0edaac3a0dc77f0d213de6c83148177aee24585e
SSDEEP

393216:w/XMg7ol+FI1SW9drYiXhuMg75KTtyYKBpbU3jHpJMuRcbrbsZG2x9EHVHhZmQAb:wvMgMPhtygRcNkEHVHhZYfgS

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
644	visualboyadvance-m.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	visualboyadvance-m.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	visualboyadvance-m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	visualboyadvance-m.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	visualboyadvance-m.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
644	visualboyadvance-m.exe
644	visualboyadvance-m.exe
644	visualboyadvance-m.exe
3412	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\visualboyadvance-m.exe
"C:\Users\Admin\AppData\Local\Temp\visualboyadvance-m.exe"
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\win7527.tmp

Filesize
2.4MB

MD5
b19a3c37938ad34ac6b923fe3a460e16

SHA1
53354de7a4b8a7e814df0fde54d93bf38bb75e95

SHA256
cb13a9a6a88054a26e940a945d8e82f1ceba5858f73a57636226a09b7ce5b4c4

SHA512
70661176e4bba593ff87b678b8317ee3172173352e3a5d652a093c3dc69820a0d336304c473baeb4744725674cff2305961536be20be9301a591942bc94b3464

Download Submit