Analysis
-
max time kernel
103s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
30-09-2024 23:59
General
-
Target
antimicrox-3.4.1-Windows-AMD64.exe
-
Size
13.5MB
-
MD5
1943da99ebbe840ac89c3045fe24babb
-
SHA1
a4ca3555efc9b12e515403a79d7316ccb69a7377
-
SHA256
7c5b449226d2c3e8e65341baffb10b9393282d53b7f6fb164ed788ca2967bb99
-
SHA512
462aa3fb349c23f7b44b6ca049f3f96f363c8ce0596f6f18a09bf45c0087088d3c92f0a7195aeb69cce7c89cec38cb0df2d85c39a5defc017bf48c5308cc07f5
-
SSDEEP
196608:OZh/vKV4AhS5RX0Ooll6Vv4eCklq7CZhKNbgANGvnU8T6slsWD7PdtSX6kcFCjuh:s/9AEuzC/rLWnNAnVmW/VtQ6kjjo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 19 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 42 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\antimicrox-3.4.1-Windows-AMD64.exe"C:\Users\Admin\AppData\Local\Temp\antimicrox-3.4.1-Windows-AMD64.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files\AntiMicroX\bin\antimicrox.exe"C:\Program Files\AntiMicroX\bin\antimicrox.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.8MB
MD5f38f9d503157c6b2401801f9572fd048
SHA152f999e93532349d0fca73f49e7a4e987b4a5e1f
SHA256858abb9ddcb3cd4fa15c01d3cd64ff4371a79516b02bc3df20590a82161fba55
SHA512c31966139cb1d5df66ea5cfde65b09449d5f25d5c4fc146cd44f0e0124e8106eef124fc40e2522aaee571e4685e605ebbcab8305a23d00ab9d7828c70a7f1be3
-
Filesize
9.2MB
MD5fc7d92feb89f055f7f19169e7a1f3621
SHA15a0f1b5fa82f419020fb38010340032971495dcd
SHA2568bcf807aaf2419843a778994187fa4a2fe9e2d926435ed8add3e670935b3f9aa
SHA512e97dbc3afc7875dd753c10804aa1c98abc6462f4a295ef88f9f96292a620d607f8d67fb3172a4eca72664f7c0e928e2709dfff42586f516c4ba3567fa4a334e0
-
Filesize
2.6MB
MD594da65cb700658388a9cc3478abee446
SHA1d6eb041d57a730ca203a00c925281bc112a99fda
SHA2567660849b5647d0cd1c893fd0f977474df7b968bfae17cec79dbc77359f4e01f3
SHA512d71046b4a48ee6b085d10131a4bdd77045258685d6d10cff8626e7c5ed1a02218e095dc5e3a63b57868d84ab71b41e1265b7f8cf87fe462c90e8d7ec1248e699
-
Filesize
8.3MB
MD5f4cf06dedf04a732be32acd1291cf032
SHA18b9f8b822722537cf3043bc0e3a0069c33c1c66b
SHA256f1cdc4e0717d054a654373c52d98b8730d4dfd48eac0e5d9f518d9cede45fcdd
SHA512e0dd90285afafeef96776c268672283604c61502f7ca7d165b054654e6ca960f0e9087f56693fad48d4d18c78b44fe7e5f05988739e789a1712440c3a742dc3a
-
Filesize
2.3MB
MD5b2514da39175d249b3d74caf2fd64004
SHA10587d0f97c030d485fd6f8d4aa0b134873f58f00
SHA256ae168d45449e24b4bafe6aeed16bfb89e01453db4b83d7d0ac884f9f33125ed1
SHA51204ba13e696afccf7e71b6e6bb78ba31efd2fed275380dfe643e5566a28e8d9d3e78e8b7c7246405d6bdb62d0347df740941b81303c2db3a7a284ffd3d49681fd
-
Filesize
4.4MB
MD574fb30272498eb73ef8376a973aef75b
SHA18809cb445f2b9c7fb79a6afe35c112c67a6d120c
SHA2564d4d616c9345591e6d4832891a3634e151680aa84199623e8d92d2597957d52c
SHA51290cd289c720cd034f023af53b3413dc0e37234e418389cd92d5d04a7e8510b24487b0f53dc6c0363c1465268dd537b2b3411ba69e4b6d715642096689a5fa403
-
Filesize
3.3MB
MD5f57fd8bbfab9f786ccb60d663745c864
SHA175b50bd80e01650f97119648f6aebfb736b89e99
SHA25613071dc72a97cf3c84fa754714c99f3b91f3aa784393994401bec0a7869cdb51
SHA5127fd8b7c323d52188575d6054cbf561a05bbc688d002f8d80a0c0d915a6cfc9537755d520482126dac334e6f08d4519977be5f97ed52964076d8ba992222c92a1
-
Filesize
147KB
MD525d035933434a273b7916e6eb443d3b6
SHA1f829301691214d24f6d989e7c948ffa8d8d64c37
SHA256b22b954397a52703579d92db64b57812af70f2afcafe2e742a009c1640b9ec1a
SHA512e3c1620bc24ea117279074ee01810e99be342649add6a80728b42ffc06e223e9eb65f16f6632ccec93e96f880304536a1b8dd4f0ac8c2ead1550290e11cea1c0
-
Filesize
670KB
MD57d8cd03c4d24a26d5e5b2f188773d852
SHA1583613b44fc1bdd81559c15d281444ae82e9d9c4
SHA2566ba837ce8bafe2bad595164f14bc3e85905e5c7fe88a0a0efb99a2ba9f025f72
SHA512c50f14e5126b28ed402314a641b969c1a0f47a5856a5a607ff0df9b5bbcde44a7ead460cc5dece25ba3ec8e00c9d165183f4a6420d60ef56e12be4f2e4cc60a7
-
Filesize
2.3MB
MD527bb0a7aeabfdc799ad34a6ae2a24c57
SHA1099bfb10b27edf7a52d0e75aee32b0ef5a04743a
SHA2560d9c01ab1771df439c75f144b2d855b4ac400243f006d14d9a043493de628f0d
SHA5124cf25bd823f447022f6ba5b70f8661321f0b0fb7dae1ba009d85e7ce13229d0d511ac092b26c3cbd7860ea43f99c600a3a2a66407d71df29e094b109d29f4b99
-
Filesize
59KB
MD50a96ae22a032189a0919737b4007ab74
SHA16ccdd0955d223bbfd1c2c12bc84b20f9f9706243
SHA2565091b85a2a73b82aa3cf433f51af338f6245319d1c041bc26b42a61cbdb2f880
SHA51274b693c3957dcba750dbb12817e0722406da00505611a583e23d7bf8883d6c50ec76581d34ae9166fb6323480abe919bd5017093e2dfad7d12f92d76e5a8d53c
-
Filesize
2.8MB
MD57c0f42ae64400b354ce7ea9bcaba32c5
SHA1d7615621225849c3d6f7e37c10e492ca8820f27a
SHA2565420275c89725866b70bd24b7b556222ff7ea47fd1effdecef0d0a1c20405c43
SHA512c29d84e2685128e746808243d090497b6326196c32bd4385fabeee66e971989a1ecd57e87a01d5e222aba6edd0c27165212fb5aeee9029fb32e758cbb3726ea4
-
Filesize
193KB
MD5a20bf8e012d950a67478f7aced384489
SHA15e1c40190db6bb95e33c6db01a01474a5b745528
SHA2565080eef3f278b60b19c6a1de062370a8da7a99be9a0cf7f4310c18077c8f1e72
SHA512e1db2e835da1ad14545f5561f81a0efca2ef4ef5bcc38392c51aa63e53113eed69a4db1f28102ba2ec481e93cc65c24dc17da5ce3d79015e7e833f51cb166c43
-
Filesize
128KB
MD5f49f4482984aa91e015d701d510c76cc
SHA18c6780ef9d0c41c84ce15987e796699028a4e147
SHA25613075383033ff4f0ec8b30c676f41a482d5dc71e9374f5f205db40b11d530f45
SHA5128029bcacc2cbe1d6cc3da7ac4778a19d5b432afc1f2648e986975cda6d1550631df6cfd1367f746d5cc6f3cb3cd65f88ae1151a462f26d32f0ac1736f218b29e
-
Filesize
30KB
MD5a7d3a18ddc6206b7d980a40700ea6619
SHA12da1598e44a0d7541c236d678bfffb28de805c08
SHA256c555c346cc1f80ff0cb9aeaab8875a10c15ea4e5cf445a0f1597363fcf686924
SHA51253bffcd80bf3b8da2c1576b57bf4f993abed8a8c45f3831db4a983f05651bb6c22678b903e0c66fe2bc303fa2c8ef9b333826a998e0bf96719e4914c62efa374
-
Filesize
1KB
MD51478c5a8d40faf213ed27db7c67f7ec8
SHA17a3e685cb17e1763ef4b31e82d83ab94239f1a63
SHA25646407f1bfdb16c8880881587001a142086bfd80316e1fc06946505885f152d21
SHA512dd0e648d4d07769b027d908ff58d813561ecaab282cb94b91de86bfe0efe1bd2b36d48830d2cfcf239918d34c3773a7c68332562110c53c94c4954e69991ec27
-
Filesize
1KB
MD5a410f397b082b72a9f8f856ed4805d08
SHA1330ff7034e75b0c3f5b299fc653d4d8d2283984a
SHA256a3d87acbd2c48db3dee50772d99447642188ee797e0228fd4f2753ecb10da52d
SHA512abbf136984762f80c9da7f95e65f6d86ebef40ac3b21e71209fe882434d6f40661b9c12fe2eb90d47e64829d20b268a48948ad90fbd138be6b5db89481fea080
-
Filesize
11KB
MD565c301d9a85f4342cdef7fedeabafd5d
SHA110606ffc00f2400fb2f52d404b30115cb33137e9
SHA25648765294aa273ec2fd55cc5f9301e138b4d56a9f6d00fcf24473788e64b52bfd
SHA5120dcdd78d8f472168614200900afd479a60106c94deda18c9999c32b1af497c32d9fd41f6039d94bfa28855121e61fb4031e4464b2f074d9fb7024f5f74950efd
-
Filesize
25KB
MD546de30b73f6fa1d4ef62ba7b169e0191
SHA159850382f1f5f30c840f502d8fc5fc228df33d6d
SHA256322e35bcdd0dd61cad8810bb446c425d8b91ceeba897b13fa0f50f1f48f88056
SHA5122e51a23297bbe74bb1b1ecc5a7257c546ea43d864e0691a437577431d022f6be5e653dc1ce186698095833245c869bb769c7088ece85851f539b9b763b2cef70
-
Filesize
7KB
MD55df25c042bdda748d1f396b4fe070ede
SHA1e470ebe89bd49373f4175b5cf796c49ca1ee9a4e
SHA256c9dd715d31c8cdf763f5edc92b8228df617bc528d7f558d6e531434c62a4b37b
SHA51229bfd4d17200286bb84b9956f21f43aa8ae470870835064d60f2de2ef535535115c17a7bce75935518c0aec18db4bde700740d4b7227ba18a34ac57bbaa4657f
-
Filesize
1KB
MD542c73674148ec68e7f75fbb998634b24
SHA148ec87c5d0bd2759a23440f6343c6c063da303a1
SHA256f26b3f2af4e113ba37ad5c2a8ae5b4bbf8ae2aec6030314415a6516a9220300b
SHA512e355a0b7d97d5a531ba74a5d7cdd3947fdebc4061c639ce50ca9e080b6e5c0ba6345de77dc219998a9683104a6a2ffd8de3a576fcb313c4183e8fab1a7f9b12a
-
Filesize
1KB
MD56fcc836873cd05da9540f7fa5705df45
SHA1432e99e2eb3a04302385e07e78449ab410bc1d9c
SHA256ce9f079b81884232fba556b4ade7e0d3e9b0f1b190d5264a38fe0104588ae9af
SHA5122a9e2d9c160610d7ae8eae48aa8ae0c607837156d3aff249218e228b141b64553d7f45e8be05d396e959d30608ab724ed32f5857ee29ccd969f3ad997a6015ea
-
Filesize
1KB
MD537e6b4d9d9295e7548f9580f9830bb46
SHA1c8b2312902fff3f6b3a369e96fca6b8b47a1410f
SHA256e724bdd645edc9709e55a9887a05e7690d8a6a11116ab76102d062bc990d8de4
SHA512c231b2d6a2ab9be76789ce60d365ba8af3a25849d11456a1cd2f9bd86cb228431d4f9f9b83568478767fbfeeb3f044d7dbd5be4a7d27f7836ff3f8521e4b827b
-
Filesize
64KB
-
Filesize
5.5MB
-
Filesize
6.8MB
-
Filesize
3.4MB
-
Filesize
5.5MB
-
Filesize
3.4MB
-
Filesize
6.2MB
-
Filesize
3.4MB
-
Filesize
6.2MB
-
Filesize
6.8MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
88KB
-
Filesize
176KB
-
Filesize
1.7MB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
6.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
80KB
-
Filesize
1.5MB
-
Filesize
80KB