Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05/09/2024, 21:51
General
-
Target
e7693cde101094515493ca3465bfc9f0N.exe
-
Size
2.5MB
-
MD5
e7693cde101094515493ca3465bfc9f0
-
SHA1
e7bc9dc3377f9fc34c0308c096059ba6fce0cadf
-
SHA256
b4524a977ddb9cf1c5bb2e6e56319887d7a764c50c9ba3e5a9f5a68da1387cc3
-
SHA512
ead2358f7c779e5ac5cd4013547ea62ce75cb738b741d736c14da9681e1526f42d02036e1058e75d159c07ed6843e59cddbec3eeb055f50fb862d11fffd870fe
-
SSDEEP
49152:XxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxa:Xxx9NUFkQx753uWuCyyxa
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 16 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7693cde101094515493ca3465bfc9f0N.exe"C:\Users\Admin\AppData\Local\Temp\e7693cde101094515493ca3465bfc9f0N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5847b52e215c7be3adc6b3dc970c42714
SHA1d74e57cb21f6b0ba17d09fe67a90a19ab340a92e
SHA256d5fa29f010c652b108921080a9dcb9be55e8ad33954fa94c90533cce37820440
SHA512f60567603d4c77aaea20ab0a7a17960e52b804764edaaefc9dd65769688ee626aca7da07cac184da46fea185ab5f5764a9b76789e2d2cb83aec20f74ac7fa16e
-
Filesize
2.5MB
MD52198823ca5963aa17cbf634a4531b828
SHA17fd10e4ce11d270f82857e6a7f297d72e970fc72
SHA256781422075d20a32e646991e3fa5ec9d03ae5a952c0aca43e675fea88dd00d5f6
SHA51261cfefead8a963040f3154839782e7705fd04559e86c8c241d24e703713ed813887d2c9621e17772891f87a0b22ded1136f7cb9a57a50cfc5e9b3e171d914057
-
Filesize
2.5MB
MD597c066b3694a296237ee51970f386055
SHA11a6959cedb703bf99df37a0e7a8f0090f287efed
SHA25653fcb75710f72c6a6504997e715a335a539da3864c3d9bb4b2039c7f3cff9a9f
SHA5121d8d2284b1758038cda4564d3d91e5b0cd231ab1fa025ed17452d9454e56e85f3db354af1d874aeda5b8c5998be9bad2647e09b435d7112a3bd375645978a2ff
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB