Analysis

  • max time kernel
    104s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-07-2024 11:59

General

  • Target

    abed2a9120f50e91f1770036ad4ad4b0N.exe

  • Size

    500KB

  • MD5

    abed2a9120f50e91f1770036ad4ad4b0

  • SHA1

    02560252e65c440293ecbc6aeb9e1696c5489ffe

  • SHA256

    eb0d3f0eb2f3ec034585e14dd757bcd5d8d18e614dbfbf9ceef04738c5df6970

  • SHA512

    856e7c17297a27a81b9fb477cac9684cad20b2d1dd4a5f3d096dd74f96ff43a45cb06f7e4f34c3d8528d6b6b3daeb5ff5a9fcd1a75de6d58406135025692ca7f

  • SSDEEP

    6144:5DnLOwy4tHrz1OScjENww0vg0zmsmgMcx/hUtPoFjdz5ht7pOZ520TPS3t/0Roue:5DLOzkHrz1Zcs0vXPflSCtOwAouJCQc

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abed2a9120f50e91f1770036ad4ad4b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\abed2a9120f50e91f1770036ad4ad4b0N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Users\Admin\AppData\Local\Temp\n3713\s3713.exe
      "C:\Users\Admin\AppData\Local\Temp\n3713\s3713.exe" ins.exe /e 12617889 /u 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f /v "C:\Users\Admin\AppData\Local\Temp\abed2a9120f50e91f1770036ad4ad4b0N.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 4476
      2⤵
      • Program crash
      PID:2336
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4372 -ip 4372
    1⤵
      PID:2288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\n3713\s3713.exe

      Filesize

      282KB

      MD5

      29c1470cbf58838dc6a3f9d624b4527f

      SHA1

      e8d1d1306e44b47e36b03ade24deb56e98bb82d4

      SHA256

      dd056f949a90c1de581ddb0b16c5d49309cfe99926cd397fc31cff7e4895141d

      SHA512

      9e90bcd2f0ff30b035531c1fd885034f6e6763d4e566bf0a0ee5b8238fdfc62d581c6c3f4e97cf36f374e1b8597fe0b39544bb30c9b7d8802cef98cc4880bd57

    • memory/1520-11-0x00007FFC18C55000-0x00007FFC18C56000-memory.dmp

      Filesize

      4KB

    • memory/1520-12-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

      Filesize

      9.6MB

    • memory/1520-13-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

      Filesize

      9.6MB

    • memory/1520-14-0x0000000001010000-0x000000000101A000-memory.dmp

      Filesize

      40KB

    • memory/1520-17-0x000000001BE60000-0x000000001C32E000-memory.dmp

      Filesize

      4.8MB

    • memory/1520-18-0x000000001C330000-0x000000001C3CC000-memory.dmp

      Filesize

      624KB

    • memory/1520-19-0x0000000000FF0000-0x0000000000FF8000-memory.dmp

      Filesize

      32KB

    • memory/1520-20-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

      Filesize

      9.6MB

    • memory/1520-21-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

      Filesize

      9.6MB

    • memory/1520-22-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

      Filesize

      9.6MB

    • memory/1520-23-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

      Filesize

      9.6MB

    • memory/1520-24-0x000000001D580000-0x000000001D5E2000-memory.dmp

      Filesize

      392KB

    • memory/1520-25-0x000000001FD70000-0x000000001FEAC000-memory.dmp

      Filesize

      1.2MB

    • memory/1520-26-0x00000000203C0000-0x00000000208CE000-memory.dmp

      Filesize

      5.1MB

    • memory/1520-27-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

      Filesize

      9.6MB

    • memory/1520-29-0x00007FFC189A0000-0x00007FFC19341000-memory.dmp

      Filesize

      9.6MB