Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 02:10
Static task
static1
Behavioral task
behavioral1
Sample
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
Resource
win10v2004-20240426-en
General
-
Target
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
-
Size
3.3MB
-
MD5
19e3cbfb7e26ddca6332bbcd62f5d78c
-
SHA1
67eb601047ccb6ba96de875a2326fe55da2f1dc2
-
SHA256
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403
-
SHA512
e18d1f824a2e7ad783e79a2db1e398a4a48d37f60d1f82d73f6b65ed70c98c0cdd6e605423453d6d05512aa0e2afbf77680758409d18d3cb0382f646d62b8769
-
SSDEEP
98304:3QOH5raT1GoHKqUifIwY/L4a3X62BcFOg/9MRhM6+baj:nHcBHKqUaS/LO2BM9MDMF
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exedescription ioc process File opened for modification \??\PhysicalDrive0 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 2824 regedit.exe -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exepid process 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exepid process 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exepid process 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.execmd.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2288 wrote to memory of 2148 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe cmd.exe PID 2288 wrote to memory of 2148 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe cmd.exe PID 2288 wrote to memory of 2148 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe cmd.exe PID 2288 wrote to memory of 2148 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe cmd.exe PID 2148 wrote to memory of 2088 2148 cmd.exe net.exe PID 2148 wrote to memory of 2088 2148 cmd.exe net.exe PID 2148 wrote to memory of 2088 2148 cmd.exe net.exe PID 2148 wrote to memory of 2088 2148 cmd.exe net.exe PID 2088 wrote to memory of 2144 2088 net.exe net1.exe PID 2088 wrote to memory of 2144 2088 net.exe net1.exe PID 2088 wrote to memory of 2144 2088 net.exe net1.exe PID 2088 wrote to memory of 2144 2088 net.exe net1.exe PID 2148 wrote to memory of 2640 2148 cmd.exe net.exe PID 2148 wrote to memory of 2640 2148 cmd.exe net.exe PID 2148 wrote to memory of 2640 2148 cmd.exe net.exe PID 2148 wrote to memory of 2640 2148 cmd.exe net.exe PID 2640 wrote to memory of 2684 2640 net.exe net1.exe PID 2640 wrote to memory of 2684 2640 net.exe net1.exe PID 2640 wrote to memory of 2684 2640 net.exe net1.exe PID 2640 wrote to memory of 2684 2640 net.exe net1.exe PID 2148 wrote to memory of 2736 2148 cmd.exe SecEdit.exe PID 2148 wrote to memory of 2736 2148 cmd.exe SecEdit.exe PID 2148 wrote to memory of 2736 2148 cmd.exe SecEdit.exe PID 2148 wrote to memory of 2736 2148 cmd.exe SecEdit.exe PID 2148 wrote to memory of 2692 2148 cmd.exe net.exe PID 2148 wrote to memory of 2692 2148 cmd.exe net.exe PID 2148 wrote to memory of 2692 2148 cmd.exe net.exe PID 2148 wrote to memory of 2692 2148 cmd.exe net.exe PID 2692 wrote to memory of 2832 2692 net.exe net1.exe PID 2692 wrote to memory of 2832 2692 net.exe net1.exe PID 2692 wrote to memory of 2832 2692 net.exe net1.exe PID 2692 wrote to memory of 2832 2692 net.exe net1.exe PID 2148 wrote to memory of 380 2148 cmd.exe net.exe PID 2148 wrote to memory of 380 2148 cmd.exe net.exe PID 2148 wrote to memory of 380 2148 cmd.exe net.exe PID 2148 wrote to memory of 380 2148 cmd.exe net.exe PID 380 wrote to memory of 2740 380 net.exe net1.exe PID 380 wrote to memory of 2740 380 net.exe net1.exe PID 380 wrote to memory of 2740 380 net.exe net1.exe PID 380 wrote to memory of 2740 380 net.exe net1.exe PID 2148 wrote to memory of 2824 2148 cmd.exe regedit.exe PID 2148 wrote to memory of 2824 2148 cmd.exe regedit.exe PID 2148 wrote to memory of 2824 2148 cmd.exe regedit.exe PID 2148 wrote to memory of 2824 2148 cmd.exe regedit.exe PID 2288 wrote to memory of 768 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 2288 wrote to memory of 768 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 2288 wrote to memory of 768 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 2288 wrote to memory of 768 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 768 wrote to memory of 2540 768 net.exe net1.exe PID 768 wrote to memory of 2540 768 net.exe net1.exe PID 768 wrote to memory of 2540 768 net.exe net1.exe PID 768 wrote to memory of 2540 768 net.exe net1.exe PID 2288 wrote to memory of 2548 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 2288 wrote to memory of 2548 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 2288 wrote to memory of 2548 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 2288 wrote to memory of 2548 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 2548 wrote to memory of 2600 2548 net.exe net1.exe PID 2548 wrote to memory of 2600 2548 net.exe net1.exe PID 2548 wrote to memory of 2600 2548 net.exe net1.exe PID 2548 wrote to memory of 2600 2548 net.exe net1.exe PID 2288 wrote to memory of 2612 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 2288 wrote to memory of 2612 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 2288 wrote to memory of 2612 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 2288 wrote to memory of 2612 2288 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe"C:\Users\Admin\AppData\Local\Temp\8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\¿ªÆô¹²Ïí.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exeNET USER Guest /active:yes3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 USER Guest /active:yes4⤵
-
C:\Windows\SysWOW64\net.exeNET USER Guest /passwordreq:no3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 USER Guest /passwordreq:no4⤵
-
C:\Windows\SysWOW64\SecEdit.exeSecedit /configure /cfg "security.inf" /db secsetup.sdb /areas USER_RIGHTS /verbose3⤵
-
C:\Windows\SysWOW64\net.exenet user guest /active:yes3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user guest /active:yes4⤵
-
C:\Windows\SysWOW64\net.exenet user guest ""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user guest ""4⤵
-
C:\Windows\SysWOW64\regedit.exeregedit /s ┐¬╞⌠╣▓╧φ.reg3⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\net.exenet start workstation2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start workstation3⤵
-
C:\Windows\SysWOW64\net.exenet start "Computer Browser"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start "Computer Browser"3⤵
-
C:\Windows\SysWOW64\net.exenet start server2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start server3⤵
-
C:\Windows\SysWOW64\net.exenet start netbios2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start netbios3⤵
-
C:\Windows\SysWOW64\net.exenet share ±¾µØ£¨CÅÌ)=C:\ /grant:Guests,full /grant:Everyone,full2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share ±¾µØ£¨CÅÌ)=C:\ /grant:Guests,full /grant:Everyone,full3⤵
-
C:\Windows\SysWOW64\net.exenet share ±¾µØ£¨DÅÌ)=D:\ /grant:Guests,full /grant:Everyone,full2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share ±¾µØ£¨DÅÌ)=D:\ /grant:Guests,full /grant:Everyone,full3⤵
-
C:\Windows\SysWOW64\net.exenet share ±¾µØ£¨FÅÌ)=F:\ /grant:Guests,full /grant:Everyone,full2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share ±¾µØ£¨FÅÌ)=F:\ /grant:Guests,full /grant:Everyone,full3⤵
-
C:\Windows\SysWOW64\net.exenet share ÎïÀíÖ÷»ú×ÀÃæ=C:\Users\Admin\Desktop /grant:Guests,full /grant:Everyone,full2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share ÎïÀíÖ÷»ú×ÀÃæ=C:\Users\Admin\Desktop /grant:Guests,full /grant:Everyone,full3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Admin\Desktop /e /t /g everyone:F2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\¿ªÆô¹²Ïí.batFilesize
242B
MD580f0e65f938e3259b19f89241858ae23
SHA1f6d463a58007cc20b70988563c49b3410e68e92b
SHA25649b26f11aa955b7db4acc775b09476638525772c1a09e7c31dfdca19f6973dba
SHA512d51279e860cf401cba03c90d4edea4cfe408725b6a8737cfc3c63110f7f13f63f52ed350c2e79d1a287172d8c77d6a7dc658a1ac1d4867504a886aa108501d95
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2288-0-0x0000000000400000-0x0000000000C6A000-memory.dmpFilesize
8.4MB
-
memory/2288-2-0x0000000000400000-0x0000000000C6A000-memory.dmpFilesize
8.4MB
-
memory/2288-3-0x0000000000400000-0x0000000000C6A000-memory.dmpFilesize
8.4MB
-
memory/2288-4-0x0000000000400000-0x0000000000C6A000-memory.dmpFilesize
8.4MB
-
memory/2288-21-0x0000000000400000-0x0000000000C6A000-memory.dmpFilesize
8.4MB