Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-08-2024 22:07
General
-
Target
4c4ad3168ff823c050f984b5e2c69810N.exe
-
Size
2.5MB
-
MD5
4c4ad3168ff823c050f984b5e2c69810
-
SHA1
5e802e2f209c9f19c2fd8b7d5094317bad4cdb29
-
SHA256
d8b6e5f27f7c466653896bc2e66519e3f3c358d0e715ebdc30f132cfe01f5891
-
SHA512
4477b36dbfbccc5aaa96a8bec3a159339251dbd22141e899aa4e1f7b58c8d89b7d44a52c6d1e7b38eba7ff91882cda73f8a6087df672370d2d9038de8836a237
-
SSDEEP
49152:JxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxR:Jxx9NUFkQx753uWuCyyxR
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 17 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c4ad3168ff823c050f984b5e2c69810N.exe"C:\Users\Admin\AppData\Local\Temp\4c4ad3168ff823c050f984b5e2c69810N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD59b4ebff746d9944a764fd7185d1a93f0
SHA10589eff5ec4a053175fb43c299dbb2cadeb1e6ab
SHA2563345dffd706149e58077b66ccdc42378ccf60b807ef56b8dc4915fd5d8eb4fda
SHA5121bbef9d4a2459c23274a277715f050a283832a3820bac602ed79364f57d897ac0ec2f0243eb2d459654bc25be495b607bcf28b60facb314cc8c283c69fc5133b
-
Filesize
2.5MB
MD5af71aa145e852ecd236dc7601c1d7d47
SHA133ac8e608d2a2fe4d8b82a4c335db7fe1542d817
SHA256c6267eb07a8a9074f1c28f9fcb65302331834b5aaa2b42a92d9cc2f51894be6e
SHA5126bbd5045c7e505f18479b6f3f7f42d443aad1a69906496e40110ec64a53c772121005f79670cbdf0cfac3c07aebd547311f1bc533b750e2b4077c72532d733a4
-
Filesize
2.5MB
MD5b0acece7a6433ff2fa70dbd6aa40c514
SHA127b4352d6d0a7b2b92beef0211a952b1e5a33aae
SHA256b36881252d71c479e1f9e3b4e88244e1231f50f04eecb6253f4b1ef410df61c8
SHA512d16ba3e56237af5552ee1646c752369de2834119cb243e6d86669783e90a5e539653906b4ca380c9015857f9ed7ac6171aa77fee869e718b8f26446b405d7fc9
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB