Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 14:08

General

  • Target

    81a09f341b601660cb8d3171a03ae7b11367f536ab4174021304bd846483d1c4.exe

  • Size

    2.7MB

  • MD5

    ca9f5b0e85b54f7f3105277f0185de58

  • SHA1

    b8cc00043eb4bf6fad0636436980adf04918a930

  • SHA256

    81a09f341b601660cb8d3171a03ae7b11367f536ab4174021304bd846483d1c4

  • SHA512

    60bbd25177b8415fd82e28f65bba5145bc50a4726c578f1045676417a88a6cf9a466cf8667ad67780ceb31de438d42b0c6ffd24a4080daff4798f793ab27f734

  • SSDEEP

    49152:VtzBOauT0i7ZSQcCG1+bLthSo9/ktjPf4EXzwgb+LquT05j:VtzaT00zcC8ahhSo9sRf44z1/5j

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Detects executables packed with Themida 19 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Themida packer 19 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81a09f341b601660cb8d3171a03ae7b11367f536ab4174021304bd846483d1c4.exe
    "C:\Users\Admin\AppData\Local\Temp\81a09f341b601660cb8d3171a03ae7b11367f536ab4174021304bd846483d1c4.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1772
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2312
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3028
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2720
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:1152
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:11 /f
            5⤵
            • Creates scheduled task(s)
            PID:2508
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:12 /f
            5⤵
            • Creates scheduled task(s)
            PID:2424
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 14:13 /f
            5⤵
            • Creates scheduled task(s)
            PID:2444
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2544

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\spoolsv.exe
      Filesize

      2.7MB

      MD5

      c7f546f26637bf8277fed9e70ab1a01d

      SHA1

      6416d15a7efb25c57fa4f9eff16cccf1b9ec3cd1

      SHA256

      1f8ac5304acde9d20a5041bbd381f8fd2231275225f4a5ce99f14c2d0dbc2abd

      SHA512

      d2a6fe7cd13bb0eb282e2b9e6dcd30339d5f64e959d2a73e53a0059e3cf9105c1d78e63bb2b2bfe640ef72c01563a76ff5059857de175095bc31df09019098e8

    • \Windows\Resources\Themes\explorer.exe
      Filesize

      2.7MB

      MD5

      9a22c6dc858a891b6b61c7f2f5afd042

      SHA1

      8d03f4403e964d16612aab32469b5e86bf60018f

      SHA256

      54a854da1d52e8e58cc1a4b05485f8ec28a9601d863c43f267bbf3c7db4886c7

      SHA512

      aeabb4d72b7c22b07fd612d0c0853000878494e94b3a8eac87e3fd8e8a42acd19923c25bc6f4e9ccc676f123542c8ea704f4bdc592e40d00d230fc0fa29c9fcb

    • \Windows\Resources\svchost.exe
      Filesize

      2.7MB

      MD5

      17185a62f70beca2d71068449dffba6a

      SHA1

      ec2912e1e88c944166114405f12b393ade1e37f1

      SHA256

      5a89fb50191bdc8ed99946d8954f3737477f6829b7402882be62c9a7a7c8fa74

      SHA512

      c3de929aa43a7e2309a665c71767e130620448b241f06dcfb2bf67a3fea3c72f4e54ad61cd63e2ad038f35f02bb2b9d7439a478c78845632b9aa08d5ccf2eb2e

    • memory/1152-45-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/1152-51-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/1772-1-0x0000000077890000-0x0000000077892000-memory.dmp
      Filesize

      8KB

    • memory/1772-11-0x0000000003850000-0x0000000003EB0000-memory.dmp
      Filesize

      6.4MB

    • memory/1772-53-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/1772-0-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/1772-44-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/2312-23-0x00000000038D0000-0x0000000003F30000-memory.dmp
      Filesize

      6.4MB

    • memory/2312-57-0x00000000038D0000-0x0000000003F30000-memory.dmp
      Filesize

      6.4MB

    • memory/2312-78-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/2312-74-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/2312-66-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/2312-55-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/2312-12-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/2312-54-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/2720-56-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/2720-43-0x0000000003300000-0x0000000003960000-memory.dmp
      Filesize

      6.4MB

    • memory/2720-36-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/3028-24-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB

    • memory/3028-35-0x0000000003740000-0x0000000003DA0000-memory.dmp
      Filesize

      6.4MB

    • memory/3028-52-0x0000000000400000-0x0000000000A60000-memory.dmp
      Filesize

      6.4MB