Analysis
-
max time kernel
120s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20-08-2024 20:45
General
-
Target
558a12bbea133185eb758e5153dd7300N.exe
-
Size
2.6MB
-
MD5
558a12bbea133185eb758e5153dd7300
-
SHA1
bb97348b9bfe7feecdedfd4ae29434d2dfd41136
-
SHA256
05bfc5c5536222b49c8217075b56fe46f941e24a157e0e83523a280e4a9bc3e1
-
SHA512
03d264d9497cf82f435d2f1ed5d4e59eca50edc2b1cc2ffc078080ea3a28af397416d7f92f6fbf4d326e3572561660b863e461a87cb467c64212444580cf59c3
-
SSDEEP
49152:lU5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/YC:lU5G4DOT5JGIVzh/5aZX0zgd0IZGpwV
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 17 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\558a12bbea133185eb758e5153dd7300N.exe"C:\Users\Admin\AppData\Local\Temp\558a12bbea133185eb758e5153dd7300N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5a748c8f97e493eb0be79fe12714fc04d
SHA1708f8522cc3250c27242077cd24e54896fe6a0af
SHA256a8deae85008faca83ed90036586182197b0f2d8c20cbceebf1fb4597ddebd014
SHA5126ba4856dcef20d78cda8b3edeafdd04c3a1accd808416d586e203b9f3393f35c554d58d14b2b1b7f053ceb131262174a8d06143f43c12f8f4d35977cc7a0052e
-
Filesize
2.6MB
MD58bd16b548431602828b0a3c9215659d5
SHA110ab6280edd971775446558bce777eed2a52f885
SHA256d2dd74948a79a1568cfa2bff4be80a7473065275112e78fc5306f7fa9b96ccd8
SHA512825559717bc7247484e6c89a5e1d44b0f6cde6474fe7902c0b1a7e55197a459687438cdc786cf1d260f6c0eacd0cbed99fe9bc44340a6b0a63af983b4b76fac4
-
Filesize
2.6MB
MD5fcfd5a914da9e01041e33edeede51d4a
SHA1bae7cd1dc53b9089edcd711140476696acf47ce5
SHA2560662f5af3d03bb606c540ccc5131491c91905e0ea7dc8773f56524ae229ce67b
SHA512c202f977ac2c1d59b2d1e1255371e65173504f1bc498a7d65d7d344f339d0dd8d1f0f9414403696aaead946dd1fdbd5f0ecb0cd0ac26759b72df66b8007674e2
-
Filesize
6.1MB
-
Filesize
8KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB