Analysis
-
max time kernel
137s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 02:10
Static task
static1
Behavioral task
behavioral1
Sample
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
Resource
win10v2004-20240426-en
General
-
Target
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
-
Size
3.3MB
-
MD5
19e3cbfb7e26ddca6332bbcd62f5d78c
-
SHA1
67eb601047ccb6ba96de875a2326fe55da2f1dc2
-
SHA256
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403
-
SHA512
e18d1f824a2e7ad783e79a2db1e398a4a48d37f60d1f82d73f6b65ed70c98c0cdd6e605423453d6d05512aa0e2afbf77680758409d18d3cb0382f646d62b8769
-
SSDEEP
98304:3QOH5raT1GoHKqUifIwY/L4a3X62BcFOg/9MRhM6+baj:nHcBHKqUaS/LO2BM9MDMF
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exedescription ioc process File opened for modification \??\PhysicalDrive0 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 2932 regedit.exe -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exepid process 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exepid process 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exepid process 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.execmd.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 4388 wrote to memory of 432 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe cmd.exe PID 4388 wrote to memory of 432 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe cmd.exe PID 4388 wrote to memory of 432 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe cmd.exe PID 432 wrote to memory of 3084 432 cmd.exe net.exe PID 432 wrote to memory of 3084 432 cmd.exe net.exe PID 432 wrote to memory of 3084 432 cmd.exe net.exe PID 3084 wrote to memory of 1372 3084 net.exe net1.exe PID 3084 wrote to memory of 1372 3084 net.exe net1.exe PID 3084 wrote to memory of 1372 3084 net.exe net1.exe PID 432 wrote to memory of 4572 432 cmd.exe net.exe PID 432 wrote to memory of 4572 432 cmd.exe net.exe PID 432 wrote to memory of 4572 432 cmd.exe net.exe PID 4572 wrote to memory of 2408 4572 net.exe net1.exe PID 4572 wrote to memory of 2408 4572 net.exe net1.exe PID 4572 wrote to memory of 2408 4572 net.exe net1.exe PID 432 wrote to memory of 376 432 cmd.exe SecEdit.exe PID 432 wrote to memory of 376 432 cmd.exe SecEdit.exe PID 432 wrote to memory of 376 432 cmd.exe SecEdit.exe PID 432 wrote to memory of 3376 432 cmd.exe net.exe PID 432 wrote to memory of 3376 432 cmd.exe net.exe PID 432 wrote to memory of 3376 432 cmd.exe net.exe PID 3376 wrote to memory of 4908 3376 net.exe net1.exe PID 3376 wrote to memory of 4908 3376 net.exe net1.exe PID 3376 wrote to memory of 4908 3376 net.exe net1.exe PID 432 wrote to memory of 3112 432 cmd.exe net.exe PID 432 wrote to memory of 3112 432 cmd.exe net.exe PID 432 wrote to memory of 3112 432 cmd.exe net.exe PID 3112 wrote to memory of 936 3112 net.exe net1.exe PID 3112 wrote to memory of 936 3112 net.exe net1.exe PID 3112 wrote to memory of 936 3112 net.exe net1.exe PID 432 wrote to memory of 2932 432 cmd.exe regedit.exe PID 432 wrote to memory of 2932 432 cmd.exe regedit.exe PID 432 wrote to memory of 2932 432 cmd.exe regedit.exe PID 4388 wrote to memory of 3940 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 3940 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 3940 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 3940 wrote to memory of 1656 3940 net.exe net1.exe PID 3940 wrote to memory of 1656 3940 net.exe net1.exe PID 3940 wrote to memory of 1656 3940 net.exe net1.exe PID 4388 wrote to memory of 3792 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 3792 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 3792 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 3792 wrote to memory of 1592 3792 net.exe net1.exe PID 3792 wrote to memory of 1592 3792 net.exe net1.exe PID 3792 wrote to memory of 1592 3792 net.exe net1.exe PID 4388 wrote to memory of 2008 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 2008 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 2008 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 2008 wrote to memory of 4728 2008 net.exe net1.exe PID 2008 wrote to memory of 4728 2008 net.exe net1.exe PID 2008 wrote to memory of 4728 2008 net.exe net1.exe PID 4388 wrote to memory of 712 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 712 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 712 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 712 wrote to memory of 1604 712 net.exe net1.exe PID 712 wrote to memory of 1604 712 net.exe net1.exe PID 712 wrote to memory of 1604 712 net.exe net1.exe PID 4388 wrote to memory of 4520 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 4520 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 4520 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 4532 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 4532 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 4532 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe PID 4388 wrote to memory of 5104 4388 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe"C:\Users\Admin\AppData\Local\Temp\8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\¿ªÆô¹²Ïí.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exeNET USER Guest /active:yes3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 USER Guest /active:yes4⤵
-
C:\Windows\SysWOW64\net.exeNET USER Guest /passwordreq:no3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 USER Guest /passwordreq:no4⤵
-
C:\Windows\SysWOW64\SecEdit.exeSecedit /configure /cfg "security.inf" /db secsetup.sdb /areas USER_RIGHTS /verbose3⤵
-
C:\Windows\SysWOW64\net.exenet user guest /active:yes3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user guest /active:yes4⤵
-
C:\Windows\SysWOW64\net.exenet user guest ""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user guest ""4⤵
-
C:\Windows\SysWOW64\regedit.exeregedit /s ┐¬╞⌠╣▓╧φ.reg3⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\net.exenet start workstation2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start workstation3⤵
-
C:\Windows\SysWOW64\net.exenet start "Computer Browser"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start "Computer Browser"3⤵
-
C:\Windows\SysWOW64\net.exenet start server2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start server3⤵
-
C:\Windows\SysWOW64\net.exenet start netbios2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start netbios3⤵
-
C:\Windows\SysWOW64\net.exenet share ±¾µØ£¨CÅÌ)=C:\2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share ±¾µØ£¨CÅÌ)=C:\3⤵
-
C:\Windows\SysWOW64\net.exenet share ±¾µØ£¨DÅÌ)=D:\2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share ±¾µØ£¨DÅÌ)=D:\3⤵
-
C:\Windows\SysWOW64\net.exenet share ±¾µØ£¨FÅÌ)=F:\2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share ±¾µØ£¨FÅÌ)=F:\3⤵
-
C:\Windows\SysWOW64\net.exenet share ÎïÀíÖ÷»ú×ÀÃæ=C:\Users\Admin\Desktop2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share ÎïÀíÖ÷»ú×ÀÃæ=C:\Users\Admin\Desktop3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Admin\Desktop /e /t /g everyone:F2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\¿ªÆô¹²Ïí.batFilesize
242B
MD580f0e65f938e3259b19f89241858ae23
SHA1f6d463a58007cc20b70988563c49b3410e68e92b
SHA25649b26f11aa955b7db4acc775b09476638525772c1a09e7c31dfdca19f6973dba
SHA512d51279e860cf401cba03c90d4edea4cfe408725b6a8737cfc3c63110f7f13f63f52ed350c2e79d1a287172d8c77d6a7dc658a1ac1d4867504a886aa108501d95
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/4388-0-0x0000000000400000-0x0000000000C6A000-memory.dmpFilesize
8.4MB
-
memory/4388-3-0x0000000000400000-0x0000000000C6A000-memory.dmpFilesize
8.4MB
-
memory/4388-4-0x0000000000400000-0x0000000000C6A000-memory.dmpFilesize
8.4MB
-
memory/4388-2-0x0000000000400000-0x0000000000C6A000-memory.dmpFilesize
8.4MB
-
memory/4388-13-0x0000000000400000-0x0000000000C6A000-memory.dmpFilesize
8.4MB