Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09/03/2024, 03:06
General
-
Target
ce7c3e44660f7c5a9edaf792afe365c4de79f28612c93a4ad0a3d8278c1e0a00.exe
-
Size
15.6MB
-
MD5
1cd6c6dc15eb17ad352302fab413f8a6
-
SHA1
eda11aba636479b472a52b1049a42f38998cac9e
-
SHA256
ce7c3e44660f7c5a9edaf792afe365c4de79f28612c93a4ad0a3d8278c1e0a00
-
SHA512
2f607cbdc3e9077214dbb482fe357606724e3236f782ed83dfdd5cca7c7390561614399fe8de4aff340d959610fd0cc8b4daa0a2fb168271d8101269fd132b68
-
SSDEEP
393216:iLVatRL3h4xNJ4ZfJ5XybaEHC/zqjgF0kE/jLKezlMC:iotRF4x/4Zx5CbPC/EJ/jLX5
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce7c3e44660f7c5a9edaf792afe365c4de79f28612c93a4ad0a3d8278c1e0a00.exe"C:\Users\Admin\AppData\Local\Temp\ce7c3e44660f7c5a9edaf792afe365c4de79f28612c93a4ad0a3d8278c1e0a00.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Edge\HaYlG9PtcB2YV23DH7ZhcfUZwC6Te0\msedge.exeC:\Users\Admin\AppData\Local\Edge\HaYlG9PtcB2YV23DH7ZhcfUZwC6Te0\msedge.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504KB
MD5d38617f36c54230df9a9080653c14472
SHA187a8026e8c8902a6a68cb712930b5b0675b9e552
SHA256933e7a80f637d954f36bb685d5c6fe70715bb506cc74fe35949e7b48fe128f91
SHA51246ae200c619691e9d302a779844b9e99e3e5e1a9b6968f0e382e61a29566088528c2b18626e5abfc775179363188ecfb5c7aa2485f07763c9972c702678d279f
-
Filesize
2.1MB
MD5335eafe9e2bbaf5bca00024dfc60cb54
SHA1627bce9a4abe1515cc2868c465b4653a67940d4a
SHA25684b18396b77635abfee64efe9aa543d5e24a5e4b98727837d1681b3a017c54d9
SHA512ed3e4f28c72afe9935e873a30e29eae040f758ad6c11d861e903facc5d1f29e7a37f5904d5a8c4762e54381f6fa3bb54498443aa612a540e98db84ee06b48596
-
Filesize
981KB
MD57d9837c7a57e266a1b350ea086209f5d
SHA17c8e25f93e089f487f0710e446324568bc18a603
SHA256e73b2fadfe3eb26a32f12af1066d92e0d18433d2e54f927e3b087c7f1aca7e6d
SHA512df8b24e30445c0720c85efb0343a88a811bcd3d707f7a7c21158be4eff600aabd7b5a629af926ebb384991470359973d800dc97c21144c82001988abfdf0bce6
-
Filesize
16.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
16.9MB
-
Filesize
16.9MB
-
Filesize
3.9MB
-
Filesize
16.9MB
-
Filesize
3.9MB
-
Filesize
508KB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
5.0MB
-
Filesize
508KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
508KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB