Analysis
-
max time kernel
120s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/09/2024, 15:17
General
-
Target
32243e5989e89d17d68546ac8d2346b0N.exe
-
Size
2.5MB
-
MD5
32243e5989e89d17d68546ac8d2346b0
-
SHA1
c1c588d84633adb83e0f701fbde18b1fe77e8920
-
SHA256
2409fa32ff82fc01133e4125e359b566ccf568285e6c1e1fb82798d78662b646
-
SHA512
212a23b2e06e919fa0ac76965cedc409d197b73f445770974c60e612aec16a65c5e6f50e393570ad9f93b9d4391dbfed14851a4e75190a8b700aae11a93f3040
-
SSDEEP
49152:JxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxt:Jxx9NUFkQx753uWuCyyxt
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 16 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\32243e5989e89d17d68546ac8d2346b0N.exe"C:\Users\Admin\AppData\Local\Temp\32243e5989e89d17d68546ac8d2346b0N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5b3b1c92fa8738c8f48cc9775586c32f2
SHA196ad2feccb8dcb74c054453c50cc092ad1f1c588
SHA2569120f1b859752991252967e3b283bc9dac62af24809f1b789522d8f231d50c85
SHA51254529da331a30f889666bd87dbc7b28a6335e47c0e6cf423582eefcd49bbdc24cb080fcc8026d57e4f2b6f5a9f62697a2a578ff64a451f2b810e1824d33b598f
-
Filesize
2.5MB
MD527ac7174e9471e698c73bd26d36672d5
SHA1d958cdb6a3a5e4e2869023adfc335e2dabb96f5c
SHA2568183120219ad591ff79c3ba310adea8fa53afa75fe858c2127b3acee12305b47
SHA512a52a6393a83bc81c647df0bec10b757071d5e7817c8cd2bc858a6f16e35eecb4ceb4b4aaeca1df654e897b012a80d34ef2f9ee796eb60d419c7ab4eefa7cb576
-
Filesize
2.5MB
MD505800f89a62414d20868eb959b9fb915
SHA140e1309f547a401000b2e5dd7a876e48ac72605d
SHA25615ca91017d85b65c4495fec6e004c3fd9e93d1b6172fffcea70eb64c48698c74
SHA5128f596aa27fe85a14f3589a1f0f2572decf3e793ba8b28ce6a820ed6f82d88b331c32b51f5efa376720d8dcb66a22b7108fb9b94292bb605cc2353fe33f111868
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB