Analysis
-
max time kernel
141s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
24-05-2024 11:41
General
-
Target
SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
-
Size
7.3MB
-
MD5
a5891df2ec1f8f0335bc744b24b4d646
-
SHA1
d8aced6d7fd09deb2580990cecd2594c17d75c4d
-
SHA256
92105da09cc48e4f81bdfe124904bef025ee94c8ed8809353b1f19193a8badf3
-
SHA512
eae0d11b4e25ab03a194c9fd0a844559b66e9f34809a34509a61f86b8a02d48193b74b937fdf2857ad473598fb3ec888d8dbf126637750bca46d0e3c7640ffa3
-
SSDEEP
98304:6iqnIOSIVtC+icuty84gK7NcnJygMABQYCFsq1kkkkkkkkkkkkkkkkkkxkkkkkkb:8IpIjut1Bc+naA6YCFVy2A026
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 1 IoCs
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 6 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe"1⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4296,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
Filesize
13.8MB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
13.8MB
-
Filesize
13.8MB
-
Filesize
13.8MB
-
Filesize
13.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
13.8MB
-
Filesize
4KB
-
Filesize
2.8MB