Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/10/2024, 13:18
General
-
Target
c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
-
Size
2.5MB
-
MD5
99ada45342214680ac3d2bde8dc00680
-
SHA1
2a03e4d3b3e3e0520bd9b662a519064cb7ace5ad
-
SHA256
c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911d
-
SHA512
85954a4c8f4487123154c97ad6043b4c68844dcb9358075cfbc150663fad8709ab9ac3b4a0e19e8875feb19f173bfeabf630e750db553fdd9ed43bff64f13dac
-
SSDEEP
49152:8xmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx8:8xx9NUFkQx753uWuCyyx8
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 17 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe"C:\Users\Admin\AppData\Local\Temp\c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD54ba5c45cfdead332f030893e2bb76873
SHA14a1a2a85c82b99629f6f4fd2888595d93cac7d9c
SHA2563d37a25bf4a96c4c16ce8391563ff92681380bd73ff3c018a6d1d92581e6920d
SHA51233add6041c3a896fc423302d361ffc5c0e82ccc9c3f039aceeaa12cc9bfed768269921880abe148fbf8175bd13270fa957622f2741d3280840ab73133b2d0672
-
Filesize
2.5MB
MD5d0e7b5bebd0186aa8a8c9a35ca195859
SHA1a23697978b4255485683bd30933202353a7065f5
SHA2569711702ff29863840161c8e4b303de0916c9cbc4040c0e421fcc264237984bcb
SHA512a52c37a60d32a02a78eafd360d29cc38c25e0031d142d32f878f175a6cd947931a259f8cc17c54c20d227ea2a17be5b5315de0f3c7c717071f4899fde995e5d1
-
Filesize
2.5MB
MD55f69cdbd4b6cb255fa9ecc8295681401
SHA126f20b3fd1807e042c311b1c397dd8d6491e215f
SHA2569f8c5259e08e53cee43dfd0eb268ca4bf7ef06b44ca137f7ec8dcaa227822d67
SHA51215ee8e6d839629beb070852721bb4f3b4e398b83e92112038f3eadf6f7272622e8ec6eb18bb0bd5b1665b791c800c2be8f9dfc33b516cce9545ba44fea56a956
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB
-
Filesize
6.1MB
-
Filesize
6.1MB