Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08-09-2024 20:41
General
-
Target
c570f4821646a996e1a70d8366cb4f6f3b4de43ab286018c32cc1802a8e55712.exe
-
Size
2.7MB
-
MD5
77060d6fac812ceba472906df731442c
-
SHA1
f97544882d5dda2a831b68bec39cb9facbaceb0a
-
SHA256
c570f4821646a996e1a70d8366cb4f6f3b4de43ab286018c32cc1802a8e55712
-
SHA512
8be3f99d113f7ae4684dbfc307c4b0c017bb2e24d7530a8c7a05712b0a5c243f3a2de1a235fcbb23042888857dc5317f0737f2d40f61f3fafa9c77500dd1d56d
-
SSDEEP
49152:w4GRMcTILl9XORhquCL7yoVVAOsie4MgOG+ebN2yOsWYGeAvuPxNf55ZGOsZVd:w4iIvXikyOCONiB65ZVzbZGOid
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c570f4821646a996e1a70d8366cb4f6f3b4de43ab286018c32cc1802a8e55712.exe"C:\Users\Admin\AppData\Local\Temp\c570f4821646a996e1a70d8366cb4f6f3b4de43ab286018c32cc1802a8e55712.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\System32\PING.EXE" www.baidu.com -n 22⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344B
MD5eb3d9e4f250a73b35c4feb6f6f47e9e9
SHA10ecf04b6e63c93511c94b3e9293956e90dd0f475
SHA256b3a4319cfd35155138604aeadac3902d3fac6e52913761f06696def6f9178dc5
SHA5126b74b70ba9f0eb8cfc78979fa03f49e6a9d36ef0ed1106feb823dc21a8ac011b4c02ded141bea1d06be72f7333c84acc034e02f7588e4f5d4adb8e67aab6925e
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
1.2MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB
-
Filesize
7.3MB