Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23/08/2024, 21:01
General
-
Target
52f90f63dda1bd833077a53c8023e34e6ad63bb5c9ac8c68259a523e00c53126.exe
-
Size
2.6MB
-
MD5
011babd2d6d343377abae9184aa12d70
-
SHA1
2d44e48fd1672f88c9b776ea24e21e5143bea471
-
SHA256
52f90f63dda1bd833077a53c8023e34e6ad63bb5c9ac8c68259a523e00c53126
-
SHA512
eb1790737980ecd9ddfb0a8878f6ef05be4d9f3d6651c894e91255bb5cea314c57f7a5b621e851dbe44c732d8d77483b10c49675e8391b369000d7f18a9f699c
-
SSDEEP
49152:lW5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/Yp:lW5G4DOT5JGIVzh/5aZX0zgd0IZGpww
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 16 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\52f90f63dda1bd833077a53c8023e34e6ad63bb5c9ac8c68259a523e00c53126.exe"C:\Users\Admin\AppData\Local\Temp\52f90f63dda1bd833077a53c8023e34e6ad63bb5c9ac8c68259a523e00c53126.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5978cef6e46f9d552f4d21c2ddb54efe1
SHA1f1a525029833c0c485b791b35a0e2093599602e4
SHA256b3f0d9114183335f11b845d6979b0bacd0846a25153f7215ee8269b2afc2e998
SHA512ace628078287f006c6e5ee0e7ea6bcb171830d00a40abb63b486a38ccc5d5ba0c30c3c485d27ff710528903e8931524b86720284121c85149facec3936627a91
-
Filesize
2.6MB
MD556f66d3b7b534c0d5b4331621a9112b1
SHA12bfcb0b381a02248f3f50e75a665036bcb6dbe11
SHA25609b8c185b769b7106c0c6544a2235b626de8affbbfdef347a7fb6bce95b9ebe1
SHA5123c76d685fdf233fda84a602f59624881c3971cd66af8dc7dd404359137cbe437c846bd7071251594401d460ec3d60d3b063324509d9c6846acbe46d3c5908e30
-
Filesize
2.6MB
MD5fa07a5bdd174263ce322c0afe7a0c0a0
SHA15b9336bdabaa0905488f7e37cebf6b34280a29c0
SHA2566b98de7c9adda51ce76e359020ea96584d700fe51a2e5ab83569d8b54d3ecb4b
SHA512c8c1016924582ecb5a8327c2156abf2474d0c6be9b837dc5ae89cbe0e3722e3e51ecc245ddaf4c7b63c48ba64bf27fefb4d7ed1875ceccd51b80f74669d9b81f
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB