Analysis
-
max time kernel
299s -
max time network
278s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09-04-2024 11:34
General
-
Target
F593AB3D9D28ED29C7E65AFE5D5C3D234E13A7D2552723565E80D954D5E15DA1.exe
-
Size
16.8MB
-
MD5
7d275755c8016baf66a2de364b5b9b3b
-
SHA1
f72d3c3578022614c6d5c8c9b5fede688e4a0b5b
-
SHA256
f593ab3d9d28ed29c7e65afe5d5c3d234e13a7d2552723565e80d954d5e15da1
-
SHA512
55f3a335bb6641c8ca1f480ed38cc85953ef85ba42b6f6cc91c01a5a5357fcf1336719fd04937d49f2bc93cfadc861fd935967ec0535e87543b0cdadb859b249
-
SSDEEP
393216:TJntyWPo+h06gwTU0eByBBpfJsB7Ja2gn9uG6DEWbSAY02znM0/JkGp5Ai:3yWPrnrXsBcvuG6AWvUndJpqi
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 32 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 23 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\F593AB3D9D28ED29C7E65AFE5D5C3D234E13A7D2552723565E80D954D5E15DA1.exe"C:\Users\Admin\AppData\Local\Temp\F593AB3D9D28ED29C7E65AFE5D5C3D234E13A7D2552723565E80D954D5E15DA1.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12B
MD5dc8ab9c2bff307e4a9545b87ffdb4899
SHA13fa9d2adfd5f8244d93e69507739b5d51bbc5677
SHA256b841da0ac26fc81e103a374fe3c1aab945a14ea9ae0437335d37e28b1f171e66
SHA512d0110d9c9077c1e8da1782afa596df39dbca237102beb0b70ea7b913d681e3cab406d238ae63e92c0ae9b5797bbdf1d82c92f561c3be675fc1bee12e1348a809
-
Filesize
12B
MD5d1c51696009b459ebfd677742b0fe0fb
SHA18896f8773e2ac35011fd3b4cff015d6ff91c4ff4
SHA256c990accbc1247d1a873a39783f5a6082e51d666f62c4e9d549dbfd36bfa255e9
SHA5128aabb0a4d571364eefa0bfc12a4297ef074d0f44c07403be928e1e49bd5f285ed24447b592f85c7f205d3e5ed57cbc9d65f46fee6fef9bb6a1630717bbbf4a95
-
Filesize
47.8MB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
2.1MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
8KB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
3.8MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
2.1MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB
-
Filesize
47.8MB