Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-06-2024 21:14

General

  • Target

    501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe

  • Size

    2.6MB

  • MD5

    9bbd5c8e035c464c64c46e376878fc15

  • SHA1

    9e09c3f7c4cb3bf9feebceb4d31d21a351e2d272

  • SHA256

    501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c

  • SHA512

    669711508e62584b8466cd66297a28cdf11676b611d3db7a3a235329785f990571f7499e12c48c1af738fa8eb13d7c291bbfc9513070c1d0ad18d98938fd06e3

  • SSDEEP

    49152:lS5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/YS:lS5G4DOT5JGIVzh/5aZX0zgd0IZGpwB

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Detects executables packed with Themida 15 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Themida packer 15 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe
    "C:\Users\Admin\AppData\Local\Temp\501d237fd04daa729fd5f7bdad701ae7d720855db59165824ab00facedab251c.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1924
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2572
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2532
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2700
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:2428
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:16 /f
            5⤵
            • Creates scheduled task(s)
            PID:2468
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:17 /f
            5⤵
            • Creates scheduled task(s)
            PID:1108
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:18 /f
            5⤵
            • Creates scheduled task(s)
            PID:1096
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2440

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\Themes\explorer.exe

      Filesize

      2.6MB

      MD5

      d19680d7b18d660f55576cc3c5fcc53b

      SHA1

      3ee2adbbbb908a7902661dce4c9300a6108410fd

      SHA256

      ee2a2406a4eddf41af01f26ce7b07a898a23e9a4f9a4c4e4cab842094bb585a5

      SHA512

      208cf09436f88a8ce5d3c9c3cb72a1150b2f6d43df59e65f10ddd51e9c660e0b80da13a1aea1dd9896015d437bf74d9ffa11ad43f2eb7865678389153d763a5b

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      2.6MB

      MD5

      04d58acb6b29f466451939dcbdce13cf

      SHA1

      3aedfdf9c33e6f131efeda38bd90c2c298320ba8

      SHA256

      6e9c1e4819527233e57d87818b5db0ffeec819e757470f0d24e287ca8d20ade6

      SHA512

      139e6b224be94500132010214f8dc06780a7537f781ea40be190fe4d4aa6c60905e862c00485b5b97e2c76198349a02303ad287ae27e46029fe0f8a9d3e63465

    • \Windows\Resources\svchost.exe

      Filesize

      2.6MB

      MD5

      db5bf47302a2121bcf3fa4d7334699a9

      SHA1

      cfe23a09ac00e8b201e895b94ad2350b6720704f

      SHA256

      44ef13ae00bdf366b1dd72054c865a7d9cca33e39bdca6a9fe14e6c13dea0c49

      SHA512

      5a4115fbc272587a94c339d5e9033ba8f49c42dccc005260b81a7aa05071257d0ccd7c0b965011003d197cf4fa1c0f31840b669a530bff661c27673e61f48154

    • memory/1924-1-0x0000000077B50000-0x0000000077B52000-memory.dmp

      Filesize

      8KB

    • memory/1924-52-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

    • memory/1924-0-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

    • memory/2428-43-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

    • memory/2428-49-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

    • memory/2532-23-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

    • memory/2532-34-0x0000000003790000-0x0000000003DA3000-memory.dmp

      Filesize

      6.1MB

    • memory/2532-50-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

    • memory/2572-22-0x0000000003700000-0x0000000003D13000-memory.dmp

      Filesize

      6.1MB

    • memory/2572-11-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

    • memory/2572-53-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

    • memory/2572-55-0x0000000003700000-0x0000000003D13000-memory.dmp

      Filesize

      6.1MB

    • memory/2572-65-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

    • memory/2572-73-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

    • memory/2700-35-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB

    • memory/2700-41-0x00000000031C0000-0x00000000037D3000-memory.dmp

      Filesize

      6.1MB

    • memory/2700-56-0x0000000000400000-0x0000000000A13000-memory.dmp

      Filesize

      6.1MB