Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-08-2024 21:33

General

  • Target

    Final_Exo.exe

  • Size

    11.6MB

  • MD5

    95ca9ea4df718e942a9469809d4d3f0c

  • SHA1

    3b10fcdad8200b06a819cce0ef2927e8ac2b41e4

  • SHA256

    2bde57f6947faaf82ac15c44168284560b7b0f4178a17aaeb6ff7347528127eb

  • SHA512

    085d634494aae323d7a632659aea6b4e61a77e7b5e960d7654b6e8dc1c32e9e2cac6c89535844b8011e3e1a5e5a027312eff03698226c2a206d436bcaa7e1cad

  • SSDEEP

    196608:K2GXWNwlpIKEmpYg0nSKOfF8UNQfjzWdRlASRXUGTgT1LglvZkgrc:KFMdSQnSzmUNSjzlSRFKglhkgI

Score
9/10

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Final_Exo.exe
    "C:\Users\Admin\AppData\Local\Temp\Final_Exo.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:616
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/616-0-0x00007FFE65093000-0x00007FFE65095000-memory.dmp

    Filesize

    8KB

  • memory/616-1-0x0000027A4E9C0000-0x0000027A4F56C000-memory.dmp

    Filesize

    11.7MB

  • memory/616-2-0x00007FFE65090000-0x00007FFE65B51000-memory.dmp

    Filesize

    10.8MB

  • memory/616-3-0x0000027A69F20000-0x0000027A6A656000-memory.dmp

    Filesize

    7.2MB

  • memory/616-4-0x0000027A69950000-0x0000027A69962000-memory.dmp

    Filesize

    72KB

  • memory/616-6-0x00007FFE65090000-0x00007FFE65B51000-memory.dmp

    Filesize

    10.8MB

  • memory/4040-9-0x000001AE99DD0000-0x000001AE99DD1000-memory.dmp

    Filesize

    4KB

  • memory/4040-8-0x000001AE99DD0000-0x000001AE99DD1000-memory.dmp

    Filesize

    4KB

  • memory/4040-7-0x000001AE99DD0000-0x000001AE99DD1000-memory.dmp

    Filesize

    4KB

  • memory/4040-19-0x000001AE99DD0000-0x000001AE99DD1000-memory.dmp

    Filesize

    4KB

  • memory/4040-18-0x000001AE99DD0000-0x000001AE99DD1000-memory.dmp

    Filesize

    4KB

  • memory/4040-17-0x000001AE99DD0000-0x000001AE99DD1000-memory.dmp

    Filesize

    4KB

  • memory/4040-16-0x000001AE99DD0000-0x000001AE99DD1000-memory.dmp

    Filesize

    4KB

  • memory/4040-15-0x000001AE99DD0000-0x000001AE99DD1000-memory.dmp

    Filesize

    4KB

  • memory/4040-14-0x000001AE99DD0000-0x000001AE99DD1000-memory.dmp

    Filesize

    4KB

  • memory/4040-13-0x000001AE99DD0000-0x000001AE99DD1000-memory.dmp

    Filesize

    4KB