Analysis
-
max time kernel
104s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
22-07-2024 11:59
Static task
static1
Behavioral task
behavioral1
Sample
abed2a9120f50e91f1770036ad4ad4b0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
abed2a9120f50e91f1770036ad4ad4b0N.exe
Resource
win10v2004-20240704-en
General
-
Target
abed2a9120f50e91f1770036ad4ad4b0N.exe
-
Size
500KB
-
MD5
abed2a9120f50e91f1770036ad4ad4b0
-
SHA1
02560252e65c440293ecbc6aeb9e1696c5489ffe
-
SHA256
eb0d3f0eb2f3ec034585e14dd757bcd5d8d18e614dbfbf9ceef04738c5df6970
-
SHA512
856e7c17297a27a81b9fb477cac9684cad20b2d1dd4a5f3d096dd74f96ff43a45cb06f7e4f34c3d8528d6b6b3daeb5ff5a9fcd1a75de6d58406135025692ca7f
-
SSDEEP
6144:5DnLOwy4tHrz1OScjENww0vg0zmsmgMcx/hUtPoFjdz5ht7pOZ520TPS3t/0Roue:5DLOzkHrz1Zcs0vXPflSCtOwAouJCQc
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ abed2a9120f50e91f1770036ad4ad4b0N.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation abed2a9120f50e91f1770036ad4ad4b0N.exe -
Executes dropped EXE 1 IoCs
pid Process 1520 s3713.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini s3713.exe File opened for modification C:\Windows\assembly\Desktop.ini s3713.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly s3713.exe File created C:\Windows\assembly\Desktop.ini s3713.exe File opened for modification C:\Windows\assembly\Desktop.ini s3713.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2336 4372 WerFault.exe 82 -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS abed2a9120f50e91f1770036ad4ad4b0N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer abed2a9120f50e91f1770036ad4ad4b0N.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4372 abed2a9120f50e91f1770036ad4ad4b0N.exe 4372 abed2a9120f50e91f1770036ad4ad4b0N.exe 1520 s3713.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1520 s3713.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1520 s3713.exe 1520 s3713.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4372 wrote to memory of 1520 4372 abed2a9120f50e91f1770036ad4ad4b0N.exe 83 PID 4372 wrote to memory of 1520 4372 abed2a9120f50e91f1770036ad4ad4b0N.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\abed2a9120f50e91f1770036ad4ad4b0N.exe"C:\Users\Admin\AppData\Local\Temp\abed2a9120f50e91f1770036ad4ad4b0N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\n3713\s3713.exe"C:\Users\Admin\AppData\Local\Temp\n3713\s3713.exe" ins.exe /e 12617889 /u 4fe0cf9f-1fe4-4abb-905a-57915bc06f2f /v "C:\Users\Admin\AppData\Local\Temp\abed2a9120f50e91f1770036ad4ad4b0N.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 44762⤵
- Program crash
PID:2336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4372 -ip 43721⤵PID:2288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
282KB
MD529c1470cbf58838dc6a3f9d624b4527f
SHA1e8d1d1306e44b47e36b03ade24deb56e98bb82d4
SHA256dd056f949a90c1de581ddb0b16c5d49309cfe99926cd397fc31cff7e4895141d
SHA5129e90bcd2f0ff30b035531c1fd885034f6e6763d4e566bf0a0ee5b8238fdfc62d581c6c3f4e97cf36f374e1b8597fe0b39544bb30c9b7d8802cef98cc4880bd57