Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14/10/2024, 23:00
General
-
Target
mw3_unlocker.exe
-
Size
7.2MB
-
MD5
f3b1ff3cf8dd2f1495a9c7b3e1990524
-
SHA1
4133e5f69660134d3f5cb6dce64b9b57f97c5117
-
SHA256
169b8c638fbaf5cbc487b3ac7556377cbaccb9bbc2a5809cff0ba276316d219f
-
SHA512
eda45ef97f3330eed85fd604518a08fc2a18122ae2c5438842e906001771f52a710dfbce288d94d3c87627ec719e0cc6364805482d2ee9b651403e96d20f9c2b
-
SSDEEP
196608:bx5QeRC8Hy5iSV4ArdlLAeg5QETwb5fk2lbIn:bxuQHy5vV4Ardueop0k2lbM
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 6 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mw3_unlocker.exe"C:\Users\Admin\AppData\Local\Temp\mw3_unlocker.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.7MB
-
Filesize
8KB
-
Filesize
17.7MB
-
Filesize
17.7MB
-
Filesize
17.7MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
17.7MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
17.7MB