Analysis

  • max time kernel
    114s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 18:11

General

  • Target

    5f5f0f0dc619a2ffa51105b117c9729327331712e3728959a98eec15c146ed9cN.exe

  • Size

    3.1MB

  • MD5

    9f1383e2d52a5b294ebe8daf13689060

  • SHA1

    bf3262405f0f337a4456b9900264039ad8054ebe

  • SHA256

    5f5f0f0dc619a2ffa51105b117c9729327331712e3728959a98eec15c146ed9c

  • SHA512

    a5b5007f5c710573b6b2227e48456c01edf4efc68004856688a804b575d5f5e159c522d081b75a65e1aa5c36539ccb5f040f4f4119483cb527f8096ab7da2459

  • SSDEEP

    49152:aPn7jMWf14IzfJSm5W/IYhYt+JawfDwqMxivs4ympISasV9U:EjMJIzfgIYhpU/qwiUZmCg

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
  • Drops file in Drivers directory 5 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • UPX packed file 34 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f5f0f0dc619a2ffa51105b117c9729327331712e3728959a98eec15c146ed9cN.exe
    "C:\Users\Admin\AppData\Local\Temp\5f5f0f0dc619a2ffa51105b117c9729327331712e3728959a98eec15c146ed9cN.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Identifies Wine through registry keys
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:876
    • C:\Windows\SysWOW64\secioit.exe
      C:\Windows\System32\secioit.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Drops file in Drivers directory
      • Drops startup file
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c icacls %windir%\system32\drivers\etc /t /grant:r everyone:f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Windows\SysWOW64\icacls.exe
          icacls C:\Windows\system32\drivers\etc /t /grant:r everyone:f
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:2532
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c echo y|cacls %windir%\system32\drivers\etc /g everyone:f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:744
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo y"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2324
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc /g everyone:f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4432
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh ipsec static delete all
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3704
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static delete all
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1124
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh ipsec static delete all
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static delete all
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4508
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c netsh ipsec static delete all
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2232
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static delete all
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4260
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\updata.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2408
    • C:\Users\Admin\AppData\Local\Temp\78wen49.MIR
      C:\Users\Admin\AppData\Local\Temp\78wen49.MIR
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Drops file in System32 directory
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Windows\SysWOW64\secioit.exe
        C:\Windows\System32\secioit.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3612
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\updata.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\78wen49.MIR

    Filesize

    3.1MB

    MD5

    eab40fbfa1e9c1e2ce17b40563fa139c

    SHA1

    8b56ef640e4248bb7b06d7a05401d59f4a63f00f

    SHA256

    bac4eda436c4581cc7685323d033359655051238d4325a72dc73f35305f67b3d

    SHA512

    931ebb7f8b4c76010d10534cb5513010ac8ef8c9c504c069e3883b12acc66792720126ee9e6594ab21a5183bfaea5cc1729008018f2edc35935f784b9ed3a868

  • C:\Users\Admin\AppData\Local\Temp\updata.bat

    Filesize

    9B

    MD5

    0f7a94080870b545360292682eed22f2

    SHA1

    ad613ab81429ee8082fc53c4bc5a5c398dfc679d

    SHA256

    e42746069d2eb9fda1c664b91c224867304423fd496d25bdba0757f9c62f8ad6

    SHA512

    b02d7d854cb15bd9cf2b7e0768196b693a0b32e5c5f75835c68198d7981cde6172fac78e81eda6050ffcb0d91561c864d2b5f979af2554b476455f9b3542552a

  • C:\Windows\SysWOW64\secioit.exe

    Filesize

    1.2MB

    MD5

    e9011bd6a4286dbd05a84a4932044ca6

    SHA1

    8034237c355fa5d7b46207872311f11869a67e04

    SHA256

    f855f7e32d30381c64f7faa4759e710186a77aea902466e6db521f5846279618

    SHA512

    2c2e311800f2825d200529e9f266a98ef40c4fecba5fb7ed326909e2ca558426dde8350e388e041f9c7f3b561f001c441364bb9991f59b226b8f948246118baa

  • memory/876-16-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-25-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-2-0x0000000000401000-0x000000000060B000-memory.dmp

    Filesize

    2.0MB

  • memory/876-3-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/876-36-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-47-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-45-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-49-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/876-48-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/876-43-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-41-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-39-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-38-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/876-50-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/876-51-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/876-55-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/876-34-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-33-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-30-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-28-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-27-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-6-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-22-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-20-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-18-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-0-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/876-1-0x00000000771F4000-0x00000000771F6000-memory.dmp

    Filesize

    8KB

  • memory/876-10-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-14-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-5-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-4-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-12-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-8-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/876-58-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/876-64-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/876-117-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/1868-76-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1868-77-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1868-89-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1868-87-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1868-85-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1868-84-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1868-81-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1868-70-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/1868-73-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1868-91-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1868-80-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1868-72-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1868-134-0x0000000000400000-0x000000000090F000-memory.dmp

    Filesize

    5.1MB

  • memory/3612-122-0x0000000000400000-0x00000000006D9000-memory.dmp

    Filesize

    2.8MB

  • memory/3612-115-0x0000000000400000-0x00000000006D9000-memory.dmp

    Filesize

    2.8MB

  • memory/4932-60-0x0000000000400000-0x00000000006D9000-memory.dmp

    Filesize

    2.8MB

  • memory/4932-131-0x0000000000400000-0x00000000006D9000-memory.dmp

    Filesize

    2.8MB