Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04-09-2024 09:10
General
-
Target
f8e559a3d0742ad0e6980e7eabde54ac04eaf460660fc76b46abdbdc18d34207.exe
-
Size
12.9MB
-
MD5
840fb8c6a3cbf73a4c8393b411ba02e8
-
SHA1
a32c95faf9eaecee78d0d19459d49bef37d8dfa9
-
SHA256
f8e559a3d0742ad0e6980e7eabde54ac04eaf460660fc76b46abdbdc18d34207
-
SHA512
0e628d2c84c34699d9b4db3755e06adf88216d3f401a494749a9f5a40048a67e1f83fa1ab95dc2ba4b43fe9941cf4e93555a30d5fe22ad693667703cab69808c
-
SSDEEP
196608:5GORzPqL0PUfx54i8hVo7PhtU4YEMo0bb5NYwX0q6ihTxsQPRttwgA:PRzPnPUZ56O1tvR0bbHYcrxxVZHwB
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Themida packer 18 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8e559a3d0742ad0e6980e7eabde54ac04eaf460660fc76b46abdbdc18d34207.exe"C:\Users\Admin\AppData\Local\Temp\f8e559a3d0742ad0e6980e7eabde54ac04eaf460660fc76b46abdbdc18d34207.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\GameShield\PrdsdrLauRc1Y2fT\3dsMax.exe"C:\Users\Admin\AppData\Local\GameShield\PrdsdrLauRc1Y2fT\3dsMax.exe" --file "C:\Users\Admin\AppData\LocalLow\GameShield\a0bec533997cddfa.dat" --debug NFUezSLo06zDB2ba2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD56e28943943dbed3c7f82fc05f269947a
SHA18a63e27b80ed14981e3cd97f1af0cf330b638e65
SHA25671a96b64aa491c1d77083351a508af384af016b853cd582d1feda49122611c38
SHA51254a9a33a7bb509ddc27de0f61f0df2f9f6f93ada7f5eebf8bc9a22e9a5c462a30c17488435c1c3ac0370d0585e25418bd848e9b4f87fcbc00d7ca664d35869ab
-
Filesize
6.8MB
MD50a4528d5b2fd082d2b5da2347de7b38b
SHA191dd0ac80885d0e652ac701ca9bbe5c1f919222f
SHA256f6269d62ae374056bf0779b763e3f12c27f1e44dc9df85a0e5f7a2445ba76868
SHA51296f6f9eda2c8022ccab127b4ac70cb0d729b32b3985d1a636f29f58f98d45ece8ebda37be3c60e348fe8c7cae1315f631720a5cdec437da528e8d710d0018359
-
Filesize
289B
MD5f79d130fe5eb7adb5ea6d79e3c18e444
SHA1851a8ec8469251efeb875e878dc7a5f1ca26fbec
SHA256805a7922dcff943ad9a5948eff0f38b0b39ffd41ddff05eab8bb905c7a122e3c
SHA512b016ee6e5da5b947054c31ea59f98b8aee09b93158eba5abb4eb2903eaa154a2a4139b88ae7de531cff33e15d3355bd08c8c8b2d880a76d5598e9bc06626218b
-
Filesize
112KB
MD5d4736d7dead55676c8f42c92bbe01420
SHA1737179a8c52c0eac9fbd3121b5c313e4d1fe372a
SHA2569205116263333633a1fbc9b2a88cfd5c05f0bd8ec3f330303c52f53255f1307f
SHA5121b139a1d415e9ed8e10a664eb9f02a413f9c8c561ae1b17012e2f062dc8a9611a52307f2acbe4607cb545b9402be5916ef1a75b57b68526f923d4d3e33094169
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB