Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/10/2024, 15:30
General
-
Target
VirtualBoxPortable.exe
-
Size
109KB
-
MD5
338e285b58c35ec242b89b837407ff77
-
SHA1
9ac416b575edfc0396e8322b739534b1856d0019
-
SHA256
154eb4a2a453337fd81fdfb626c093929d498d56c25ee041cdaa8b5f2d3f8dea
-
SHA512
2ef41e897452c0a03ee350bd123f8a68f4071f316a3aa4fcf5ac118efa0a223d94c35cd38ffce386549366f46c13fea49c1d84de851a97c3c0d120c5c21381fb
-
SSDEEP
3072:AQIURTXJeOWDxfEjBCpR+RaFrPHibxajiiiGzSRE2:AsoOWDdEYX+4FribKiGzSRE2
Malware Config
Signatures
-
Loads dropped DLL 45 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: LoadsDriver 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirtualBoxPortable.exe"C:\Users\Admin\AppData\Local\Temp\VirtualBoxPortable.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /S "C:\Users\Admin\AppData\Local\Temp\App\VirtualBox\VBoxC.dll"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
118B
MD55c8529f2f1eec4058482a2cdb9c926d1
SHA10d7d73f2ceb0f04115022cb58943773decf2370c
SHA25683d8f144affa8e7785f2aadd62d1d6955bda97f0699864f8f9476a8c5ff0349f
SHA512c90ba79a9d4983a76708fd2355c13636d7fc774958b3efaeeb0db528129413d5884917472b83f3ccd394e7849f848a37ad0cbeecb7bfe57b5dd2c7d93b036437
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
16KB
MD524a7a119e289f1b5b69f3d6cf258db7c
SHA1fec84298f9819adf155fcf4e9e57dd402636c177
SHA256ae53f8e00574a87dd243fdf344141417cfe2af318c6c5e363a030d727a6c75d1
SHA512fdbbedcc877bf020a5965f6ba8586ade48cfbe03ac0af8190a8acf077fb294ffd6b5a7ae49870bff8cacd9e33d591be63b5b3d5c2e432c640212bdcd0c602861
-
Filesize
61KB
MD5859a019ff8cd23433bb0f6147773680c
SHA181cf2c41259ff5abc898ee31c3d67d6c0d26d506
SHA256eab581d0ba757ff654dacd3349593ebd5aab632f46167ede10111c4ad50156e8
SHA51250aa51d6f9827575cfd004e33ba4f4d17f2b24956bbdb861948419e80be4db20cda6beb6f43d3921cf9e512a61662290e037ebcdc275da7319fbc53907007ff1
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
8KB
MD59bc6c411efa742a5de7d8372afafa2fa
SHA12b57865e87c7ca2db97d0296d8cbe0183df2c2cf
SHA2560cac914c87d4e73875dea8544391e383f441d624ea5ec9a4864d056db161206c
SHA512092ef3f13a71a46df0f78a3b5eb4492bee32f1a12be27e0c534638ec7723b2a9aac23391768c352289df6a8988cbc6cf96ea22d8f1983b5ccf609e08d1db4bde
-
Filesize
42KB
MD596c1dcb4710d365fd54f54f2512d017c
SHA1bbde6e2f820e33c9cc25079e4eea2ac0d7af80a8
SHA256eea15a0a6e80590fb029553018750ba83b9d9c741c27b78c98586b9237f3e008
SHA51286c2db8005089e47b0f9965e39ebf66940adb2ac7cfd83bd9f44d3b87a67cf58f8c6080a2813345884874b02c79780cf0cf619b10b876c13de38aad0a8be63c5
-
Filesize
5KB
MD572d1177bad86f4df8eaee2a8afe50e6f
SHA1c36019dfa2ff5c90c9da31c89dfcda08f93df68d
SHA256c058f4439617bdb2019c90abd9920070a23f751b9349051d0744280cd5d9c5d7
SHA512e0e764fcafa833f94ad2d5ae2a407f3e35bd27efa078625d5a2c9372ea28d7889c4b339e457d6fd7c3c90475b2d1603142a8c46a23f59b5784478860b06ee1b3
-
Filesize
12KB
-
Filesize
76KB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
