Analysis
-
max time kernel
83s -
max time network
84s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
25-04-2024 08:34
General
-
Target
CUMMINS INSITE 8.7 Pro/INSITE 8.7 Pro.exe
-
Size
5.1MB
-
MD5
a90c789176cf3aa4fbeb1541758e7001
-
SHA1
89746901191b074d7b36ef7c17c01017a7ad9f66
-
SHA256
f5986e91f714b4f3736ee40a0e197203552034ec956b797b779decfce8e20d5b
-
SHA512
eb86d922e9d96825a3c9aaf003ff2a70ab7534b5276417ae6d0bfbb2322b4f2126e849aed6671d88c31561095d03e912c593c61acad4e03a3880ba3d6b3b844c
-
SSDEEP
98304:HKVf4M+N3gKCai9IiNFeMBAyKdpuYQmmGLQeAjMMtmr6EnQgyxcdxU:qVYiai/FeLpSmmiemr6hxedx
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 6 IoCs
-
Identifies Wine through registry keys 2 TTPs 7 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks whether UAC is enabled 1 TTPs 7 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 7 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RestartApp.exeC:\Users\Admin\AppData\Roaming\RestartApp.exe "5072" "C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RestartApp.exeC:\Users\Admin\AppData\Roaming\RestartApp.exe "1900" "C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RestartApp.exeC:\Users\Admin\AppData\Roaming\RestartApp.exe "2556" "C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"7⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RestartApp.exeC:\Users\Admin\AppData\Roaming\RestartApp.exe "2780" "C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"9⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RestartApp.exeC:\Users\Admin\AppData\Roaming\RestartApp.exe "1440" "C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\RestartApp.exeC:\Users\Admin\AppData\Roaming\RestartApp.exe "2464" "C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"C:\Users\Admin\AppData\Local\Temp\CUMMINS INSITE 8.7 Pro\INSITE 8.7 Pro.exe"13⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD51d7d8486fbdcbb080eac498a277da300
SHA1d2be7d7591c9fa096e6d15bc16b4c440f5584102
SHA2565914abb1e9dff7cbf0d9935d58c877707bb3372338e7eb45e88b681e980d33ea
SHA512576f21aa8ad74302f803e6a4bd3c6d31e91d530e41eb969f75f93b2fa2d8b967ecfffd5173e0ad11c24ef4564217737cd43882895835614ac21984ead5411732
-
Filesize
16B
MD5369ddfe9173c66657bfdeb8872d7273f
SHA1a21db8a1c0d082a8ccbef59a85f584d953ba23a7
SHA2560cd9bb8d19a3bb678d2300e9f09b2d80fd1b35f56aa5530d88482d446e740102
SHA512cb06b9bf53228d827454958ea0e080a42c0486a1921a9e205bf5f35bc048d14890ea14df759f2a2a7c12c42d8a2591286ae8210622d975d3a7d7a945eb8116fd
-
Filesize
4B
MD5b31354630625aba12cf47a8731b72e11
SHA1c4722463484941e0d702c068f41badecb2f79f1d
SHA256acb1e5e36c913ea9f4272a0be75fdbc556130c136a27c2d1a719779c36b11e32
SHA51297930ed59eb0bce2baed7bdc806725b00ccdf17ae6b14614afbca7ac4761dba5b136c958bceaa6c6edb0bf759c724b7b7aa0599f4d6bf80074be0e3b4ef13637
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
3KB
MD5021ec3cc05e073e136aa1d19e199b77c
SHA1f386c2997fd05878ee3bb9638550deed6e2cf296
SHA25686ffd39f8c53924a25935a4e1667487c2a63c7c8313e4d4f6bb13a9ac742db3b
SHA512154f53c13191fb39abbfef36ba0a06ba6c444d3a12308d749a1a6307ecd34af51337d99efd4805e275d8a9fbaeed61bd49015b31b37a8e75f317ae2588c517d5
-
Filesize
10.6MB
-
Filesize
10.6MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
10.6MB
-
Filesize
10.6MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
10.6MB
-
Filesize
4KB
-
Filesize
10.6MB
-
Filesize
40KB
-
Filesize
20KB
-
Filesize
10.6MB
-
Filesize
10.6MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
10.6MB
-
Filesize
4KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
10.6MB
-
Filesize
4KB
-
Filesize
10.6MB
-
Filesize
10.6MB
-
Filesize
10.6MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
10.6MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
10.6MB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
8KB
-
Filesize
4KB