Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 07:15

General

  • Target

    Vienna-EXEC.exe

  • Size

    1.2MB

  • MD5

    10c8524f6e32771be766ce9713bdbda5

  • SHA1

    086a7e3b346430d187bea3ac6a2c93cb6a38e765

  • SHA256

    9ce36bf852b19244ba6a3aad4cd925caf7f2de79c9580e0ed856a23baaa59eba

  • SHA512

    5da3698486a3b206bfae5b6b2587cb82ec1dca0253b602e6637afaac9f92ee6c06e9301d405505457b975ae4859800041250f30f80b957d63e1a8a4552f531d4

  • SSDEEP

    24576:14pSyydXFDFG4nqMpa0diPe0bkkh8TakoOkzLSXDjnKGYRIIGuUtxj29+DbF:ghyxlF5M0diWKkkqtBXPpOmjja+D

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 2 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 5 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 5 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Maps connected drives based on registry 3 TTPs 10 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vienna-EXEC.exe
    "C:\Users\Admin\AppData\Local\Temp\Vienna-EXEC.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks computer location settings
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Users\Admin\AppData\Local\Temp\tt.exe
      "C:\Users\Admin\AppData\Local\Temp\tt.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates system info in registry
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4364
    • C:\Users\Admin\AppData\Local\Temp\Svhost.exe
      "C:\Users\Admin\AppData\Local\Temp\Svhost.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Svhost" /tr "C:\Users\Admin\AppData\Roaming\Svhost.exe"
        3⤵
        • Creates scheduled task(s)
        PID:4600
  • C:\Users\Admin\AppData\Roaming\Svhost.exe
    C:\Users\Admin\AppData\Roaming\Svhost.exe
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:644
  • C:\Users\Admin\AppData\Roaming\Svhost.exe
    C:\Users\Admin\AppData\Roaming\Svhost.exe
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3520
  • C:\Users\Admin\AppData\Roaming\Svhost.exe
    C:\Users\Admin\AppData\Roaming\Svhost.exe
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Svhost.exe.log

    Filesize

    1KB

    MD5

    f91be20cbf7fa6f403e352d73b196c79

    SHA1

    2b27b75b7b17d7012ed7655649d644e7d105a548

    SHA256

    8d520c20017c84f0ddd5bdf341c534a9f9ec9e2b6556eaeb1df86a29cf62e0a3

    SHA512

    442ea828390f53956f3a6bcad83dc7b3ada6a01b6319a322e38a523dffaadb01649663c8e33ad898c5a8bdcf1a0ef9805f29f2b61da970a88d7176ee1ae300e6

  • C:\Users\Admin\AppData\Local\Temp\Guna.UI2.dll

    Filesize

    2.1MB

    MD5

    c19e9e6a4bc1b668d19505a0437e7f7e

    SHA1

    73be712aef4baa6e9dabfc237b5c039f62a847fa

    SHA256

    9ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82

    SHA512

    b6cd0af436459f35a97db2d928120c53d3691533b01e4f0e8b382f2bd81d9a9a2c57e5e2aa6ade9d6a1746d5c4b2ef6c88d3a0cf519424b34445d0d30aab61de

  • C:\Users\Admin\AppData\Local\Temp\Svhost.exe

    Filesize

    123KB

    MD5

    69a4f157bf0bc87f9bcddb65ef00a257

    SHA1

    66eabd44f105875d0ef922b82376e65abdbb9a21

    SHA256

    8e04e32d8aeeabf2aee325579ac865958f24892c5bee6b81f8eb98ee6cfcbe0b

    SHA512

    a85cb7fbd7d6ac1e4806cb7ff03b93552d494de9fcf36f8311ff69fd475bf3de219280a8387687c31dd5f861e8eab8bd7ec5c759f37c93034f37db81c92405be

  • C:\Users\Admin\AppData\Local\Temp\tt.exe

    Filesize

    480KB

    MD5

    bdd7e91ec5ebafbbfb0bd220b435d639

    SHA1

    5f9de84f3990584c208a961064154cf1a463a353

    SHA256

    14e81c1f6462c84909a63a34223f35b1a2b9f53a73f1e79c30c2b2a871556e6b

    SHA512

    216fbb914dc28fee7f473bbda2de9ec1fa8dcf637ddbfaaf22aec32a3ef454b3b0d8efb296c70bcfdeff0608cf8948bc8386ad8fd29da1c2f674a1bc3958e5ad

  • memory/1056-56-0x00007FFE83650000-0x00007FFE84111000-memory.dmp

    Filesize

    10.8MB

  • memory/1056-55-0x00007FFE83653000-0x00007FFE83655000-memory.dmp

    Filesize

    8KB

  • memory/1056-54-0x000000001C390000-0x000000001C39A000-memory.dmp

    Filesize

    40KB

  • memory/1056-43-0x00007FFE83650000-0x00007FFE84111000-memory.dmp

    Filesize

    10.8MB

  • memory/1056-41-0x0000000000A10000-0x0000000000A38000-memory.dmp

    Filesize

    160KB

  • memory/1056-42-0x0000000001200000-0x0000000001206000-memory.dmp

    Filesize

    24KB

  • memory/1056-36-0x00007FFE83653000-0x00007FFE83655000-memory.dmp

    Filesize

    8KB

  • memory/1344-46-0x00007FFE83650000-0x00007FFE84111000-memory.dmp

    Filesize

    10.8MB

  • memory/1344-3-0x00007FFE83650000-0x00007FFE84111000-memory.dmp

    Filesize

    10.8MB

  • memory/1344-1-0x00000000003C0000-0x0000000000500000-memory.dmp

    Filesize

    1.2MB

  • memory/1344-2-0x000000001B2C0000-0x000000001B3F0000-memory.dmp

    Filesize

    1.2MB

  • memory/1344-0-0x00007FFE83653000-0x00007FFE83655000-memory.dmp

    Filesize

    8KB

  • memory/4364-44-0x0000000005210000-0x0000000005220000-memory.dmp

    Filesize

    64KB

  • memory/4364-45-0x0000000005850000-0x000000000585A000-memory.dmp

    Filesize

    40KB

  • memory/4364-40-0x0000000005600000-0x0000000005814000-memory.dmp

    Filesize

    2.1MB

  • memory/4364-52-0x000000007488E000-0x000000007488F000-memory.dmp

    Filesize

    4KB

  • memory/4364-21-0x000000007488E000-0x000000007488F000-memory.dmp

    Filesize

    4KB

  • memory/4364-24-0x0000000005340000-0x00000000053D2000-memory.dmp

    Filesize

    584KB

  • memory/4364-22-0x0000000000830000-0x00000000008AE000-memory.dmp

    Filesize

    504KB

  • memory/4364-57-0x0000000005210000-0x0000000005220000-memory.dmp

    Filesize

    64KB

  • memory/4364-23-0x00000000058F0000-0x0000000005E94000-memory.dmp

    Filesize

    5.6MB