Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 06:31
General
-
Target
e22d52c7cda495f34f75594409a447e870bec855c939d5ab2e31154adaf91a36N.exe
-
Size
2.6MB
-
MD5
6ac3f650bcf94cb8b7a1b301fb90fcb0
-
SHA1
33979360427289f78b0a8459f02cbebea5a540b2
-
SHA256
e22d52c7cda495f34f75594409a447e870bec855c939d5ab2e31154adaf91a36
-
SHA512
56d78fe243eb86b87da2d6ccce42c62dd84e395c60760dce6afc2e8d6ca22d6559245832a1b9f1f9bfa831fb0b8e97f628dc539ce82aec6d5a96350e76fb4c97
-
SSDEEP
49152:lJ5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/Y7:lJ5G4DOT5JGIVzh/5aZX0zgd0IZGpw+
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 17 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e22d52c7cda495f34f75594409a447e870bec855c939d5ab2e31154adaf91a36N.exe"C:\Users\Admin\AppData\Local\Temp\e22d52c7cda495f34f75594409a447e870bec855c939d5ab2e31154adaf91a36N.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5f8e37e9ca9c5d456c9100940aa8c66b2
SHA1d2321cb6f4c4c5714d71411397767d04b619935d
SHA25642d276ce3eaf16ec173fcf7322ca09a97ba720b1ac1a154695e3954b193ee946
SHA512e7eedd0e324547e845bdfcd0c22c6021ab760f5c95e97a78abb95f85726e904a8a57337d3493c495c290c555b24cbecbd402e4dcde0083b06a909ec6deff065a
-
Filesize
2.6MB
MD5ebe90da4682de45cb605a4076a760402
SHA1e552e17829228f456b1cee6dd14bbe7f9440aada
SHA2564ed953878cdef6270b64097b3cdc59eb33c5caee3250fda91c0b735007086075
SHA512551be856b4a8aaded68b21c52bbd9392152409250058be2b1f0956ee961d0d9789c7098572bf84d7e8f6d1a6df42337b7fe479bb42033a747ee2d047cac077ce
-
Filesize
2.6MB
MD5584b0efae96fcf73d87f9c799ef8fb03
SHA1134c97ab727f84ad7f20505def87ab63a4745a94
SHA2561e175384fd5f8b2eb35025e76c2da8aab705ab5b4ed5562f11dbd9e61c3b03a5
SHA5123fb8684ca78258773dda167b9ee74558e474948d36f4d50720311658f578941506b27e66aabae4d3351ef3838da45082d5e35bec014d97aa76a87ace85a7a850
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB