Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-02-2024 22:47

General

  • Target

    Onyx Free Crypter.exe

  • Size

    4.6MB

  • MD5

    0639440ebf99e58c833be2870e4259b0

  • SHA1

    afbfeb6cce8b5710ddbf227f31e386ccc9c3b669

  • SHA256

    f28df7a1b0093d68e0230388c11bab5bf87ba5efc979f1a6a717f2e92d470443

  • SHA512

    3a559375273344fccc7e4cdd7ebda4eb3df439a63944208352792dc09bb478a68ec8c4a381141887e06eb0fea6dc9f88c8722f0764803f56a09d131ff31bc26b

  • SSDEEP

    98304:8b0dJK6mzAKcsfyllmpSzvyAKrtvCFbLADJyaWoKuxG/:hdJK69llcpSpKrMF3QG

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Onyx Free Crypter.exe
    "C:\Users\Admin\AppData\Local\Temp\Onyx Free Crypter.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1364
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /0
    1⤵
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3956
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1384
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4984

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\53b4dde3-ceef-4149-b63d-4b67cc36c3e9\GunaDotNetRT.dll

        Filesize

        136KB

        MD5

        9af5eb006bb0bab7f226272d82c896c7

        SHA1

        c2a5bb42a5f08f4dc821be374b700652262308f0

        SHA256

        77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

        SHA512

        7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

      • memory/1364-24-0x0000000005E30000-0x0000000005E40000-memory.dmp

        Filesize

        64KB

      • memory/1364-4-0x000000000D650000-0x000000000DB4E000-memory.dmp

        Filesize

        5.0MB

      • memory/1364-23-0x0000000005E30000-0x0000000005E40000-memory.dmp

        Filesize

        64KB

      • memory/1364-0-0x0000000074E00000-0x00000000755B0000-memory.dmp

        Filesize

        7.7MB

      • memory/1364-5-0x0000000003670000-0x000000000370C000-memory.dmp

        Filesize

        624KB

      • memory/1364-6-0x0000000001930000-0x0000000001936000-memory.dmp

        Filesize

        24KB

      • memory/1364-7-0x000000000B770000-0x000000000BD14000-memory.dmp

        Filesize

        5.6MB

      • memory/1364-8-0x000000000B1C0000-0x000000000B252000-memory.dmp

        Filesize

        584KB

      • memory/1364-9-0x000000000B380000-0x000000000B49A000-memory.dmp

        Filesize

        1.1MB

      • memory/1364-10-0x000000000BF70000-0x000000000C1BC000-memory.dmp

        Filesize

        2.3MB

      • memory/1364-1-0x0000000000DF0000-0x0000000001296000-memory.dmp

        Filesize

        4.6MB

      • memory/1364-16-0x0000000072C90000-0x0000000072CC7000-memory.dmp

        Filesize

        220KB

      • memory/1364-19-0x0000000073810000-0x0000000073899000-memory.dmp

        Filesize

        548KB

      • memory/1364-20-0x000000000B6E0000-0x000000000B746000-memory.dmp

        Filesize

        408KB

      • memory/1364-21-0x000000000C950000-0x000000000C95A000-memory.dmp

        Filesize

        40KB

      • memory/1364-22-0x000000000C9C0000-0x000000000CA16000-memory.dmp

        Filesize

        344KB

      • memory/1364-3-0x0000000005E30000-0x0000000005E40000-memory.dmp

        Filesize

        64KB

      • memory/1364-25-0x0000000005E30000-0x0000000005E40000-memory.dmp

        Filesize

        64KB

      • memory/1364-2-0x0000000001E80000-0x0000000001E86000-memory.dmp

        Filesize

        24KB

      • memory/1364-46-0x0000000074E00000-0x00000000755B0000-memory.dmp

        Filesize

        7.7MB

      • memory/1364-44-0x0000000005E30000-0x0000000005E40000-memory.dmp

        Filesize

        64KB

      • memory/1364-43-0x0000000005E30000-0x0000000005E40000-memory.dmp

        Filesize

        64KB

      • memory/1364-42-0x0000000005E30000-0x0000000005E40000-memory.dmp

        Filesize

        64KB

      • memory/1364-41-0x0000000072C90000-0x0000000072CC7000-memory.dmp

        Filesize

        220KB

      • memory/1364-40-0x0000000005E30000-0x0000000005E40000-memory.dmp

        Filesize

        64KB

      • memory/1364-39-0x0000000074E00000-0x00000000755B0000-memory.dmp

        Filesize

        7.7MB

      • memory/3956-36-0x000001C2109B0000-0x000001C2109B1000-memory.dmp

        Filesize

        4KB

      • memory/3956-37-0x000001C2109B0000-0x000001C2109B1000-memory.dmp

        Filesize

        4KB

      • memory/3956-38-0x000001C2109B0000-0x000001C2109B1000-memory.dmp

        Filesize

        4KB

      • memory/3956-35-0x000001C2109B0000-0x000001C2109B1000-memory.dmp

        Filesize

        4KB

      • memory/3956-34-0x000001C2109B0000-0x000001C2109B1000-memory.dmp

        Filesize

        4KB

      • memory/3956-33-0x000001C2109B0000-0x000001C2109B1000-memory.dmp

        Filesize

        4KB

      • memory/3956-32-0x000001C2109B0000-0x000001C2109B1000-memory.dmp

        Filesize

        4KB

      • memory/3956-28-0x000001C2109B0000-0x000001C2109B1000-memory.dmp

        Filesize

        4KB

      • memory/3956-26-0x000001C2109B0000-0x000001C2109B1000-memory.dmp

        Filesize

        4KB

      • memory/3956-27-0x000001C2109B0000-0x000001C2109B1000-memory.dmp

        Filesize

        4KB