Overview
overview
8Static
static
3Virus/Virus/Form1.vbs
windows10-2004-x64
8Virus/Viru...er.vbs
windows10-2004-x64
1Virus/Viru...es.vbs
windows10-2004-x64
1Virus/Viru...er.vbs
windows10-2004-x64
1Virus/Viru...ts.dll
windows10-2004-x64
1Virus/Viru...ts.dll
windows10-2004-x64
1Virus/Viru...us.exe
windows10-2004-x64
8Virus/Viru...st.exe
windows10-2004-x64
1Virus/Viru...ts.dll
windows10-2004-x64
1Virus/Viru...ts.dll
windows10-2004-x64
1Virus/Viru...us.exe
windows10-2004-x64
8Virus/Viru...ts.dll
windows10-2004-x64
1Virus/Viru...ts.dll
windows10-2004-x64
1Virus/Viru...vb.dll
windows10-2004-x64
1Virus/Viru...us.exe
windows10-2004-x64
8Virus/Viru...ts.dll
windows10-2004-x64
1Virus/Viru...ts.dll
windows10-2004-x64
1Virus/Viru...vb.dll
windows10-2004-x64
1Virus/Viru...us.exe
windows10-2004-x64
8Analysis
-
max time kernel
90s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19/02/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
Virus/Virus/Form1.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral2
Sample
Virus/Virus/My Project/Resources.Designer.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Virus/Virus/My Project/Resources.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral4
Sample
Virus/Virus/My Project/Settings.Designer.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Virus/Virus/bin/Debug/AxInterop.ShockwaveFlashObjects.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral6
Sample
Virus/Virus/bin/Debug/Interop.ShockwaveFlashObjects.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Virus/Virus/bin/Debug/Virus.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral8
Sample
Virus/Virus/bin/Debug/Virus.vshost.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
Virus/Virus/bin/Release/AxInterop.ShockwaveFlashObjects.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral10
Sample
Virus/Virus/bin/Release/Interop.ShockwaveFlashObjects.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
Virus/Virus/bin/Release/Virus.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral12
Sample
Virus/Virus/obj/Debug/AxInterop.ShockwaveFlashObjects.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Virus/Virus/obj/Debug/Interop.ShockwaveFlashObjects.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral14
Sample
Virus/Virus/obj/Debug/TempPE/My Project.Resources.Designer.vb.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
Virus/Virus/obj/Debug/Virus.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral16
Sample
Virus/Virus/obj/Release/AxInterop.ShockwaveFlashObjects.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
Virus/Virus/obj/Release/Interop.ShockwaveFlashObjects.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral18
Sample
Virus/Virus/obj/Release/TempPE/My Project.Resources.Designer.vb.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
Virus/Virus/obj/Release/Virus.exe
Resource
win10v2004-20231215-en
General
-
Target
Virus/Virus/bin/Debug/Virus.exe
-
Size
3.0MB
-
MD5
ceb728f44e9db8c057e307b39c67e8fe
-
SHA1
dfab0b4f0c716f5af0bcaf579a250ccdfc09ec66
-
SHA256
ed03452448f19339e1488748ad15caa629c1005cd45f2d42df3cb68b61ca70f6
-
SHA512
df4b23aaa71402e8a5d11ad0ee793b47c5562741c0c2aaa6e65c9b691d4ef30fbac7aa51b7dc1a2233430d59bf415b03293f24f75395c67834585adc2ee00245
-
SSDEEP
49152:bj3iZ1MHTIo3dLoYNiDSeP7jxPXyouZ3xtNg5EzN3CD70c5iMOIEQLx3+bt+g:bma9NLYGG7FduZhtau3Cv0cIIEQVubt9
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Kills process with taskkill 2 IoCs
pid Process 4440 taskkill.exe 980 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4440 taskkill.exe Token: SeDebugPrivilege 980 taskkill.exe Token: 33 3704 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3704 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4740 wrote to memory of 4440 4740 Virus.exe 83 PID 4740 wrote to memory of 4440 4740 Virus.exe 83 PID 4740 wrote to memory of 980 4740 Virus.exe 86 PID 4740 wrote to memory of 980 4740 Virus.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Virus\Virus\bin\Debug\Virus.exe"C:\Users\Admin\AppData\Local\Temp\Virus\Virus\bin\Debug\Virus.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im taskmgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:980
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x3041⤵
- Suspicious use of AdjustPrivilegeToken
PID:3704