Analysis
-
max time kernel
18s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05-09-2024 12:14
General
-
Target
euphon lite.exe
-
Size
6.4MB
-
MD5
bdced18de788840b3b22f090ce19cf8e
-
SHA1
e42e61012bd6ea113b58b4a2fa72f8689654fc53
-
SHA256
651092f2838d1307efdeec4bbf3b0a025811fbf91b46109d24ec06680f04453e
-
SHA512
23d91d5b57a07d812db3067dbd843a6f0f8e1167fb1e3ad0c26923001653053ef750464de278c4fa73a539b3bebbeba838db900207b8414f4892d2b9e8dba87d
-
SSDEEP
196608:WAazqSIrf+vwDInJpj5i4o6GgtlBg1Gx:UWrfcXJEsLgQ
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\euphon lite.exe"C:\Users\Admin\AppData\Local\Temp\euphon lite.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Deletes itself
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.4MB
-
Filesize
12.7MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4.4MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB