Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
16/06/2024, 12:59
General
-
Target
temp.exe
-
Size
25.9MB
-
MD5
a2d04d2e3dac93296787705fa278ff03
-
SHA1
9e57d5fb5fcb2d38f65e334c2c41692720c685c3
-
SHA256
bafb1d83e7c4921b9c830634638a3ef6ccdf35228906f0aac7694cff21f9dcc8
-
SHA512
a93b7b24c39a91e5bb68b97cbd7ee37ab9fbb40120aab428fc537babb2a1c22a7b13d51977c29a4032cc4727fe0b1bd010d7c482c8f27b64338a2c39b7386209
-
SSDEEP
393216:Sg89rFN2ecQvNz5gz1Cw0yhRiHrsCG3r574L1j6P94cn0Y1lLulRTwa7zNf7bH4d:Sg89ziQvRwzsQ1gj894cllMRDpfY56A
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\temp.exe"C:\Users\Admin\AppData\Local\Temp\temp.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31.3MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
31.3MB
-
Filesize
31.3MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
3.8MB
-
Filesize
40KB
-
Filesize
960KB
-
Filesize
624KB
-
Filesize
31.3MB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB