Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 17:03
General
-
Target
MenuExtendido.exe
-
Size
11.1MB
-
MD5
115311b89910277aa0a9b928078abf2e
-
SHA1
2632966c0bf4c1f9f802b87e98f786de16e7defc
-
SHA256
57c55450fd79ddc7fdde142603ffbd3451b656c737eae29cf5667426600128aa
-
SHA512
54a551516487f82e1c0e11781d16272c1e2ef65475fa8eca2ec5ee8a559ccfdb9439a219473ba8662166cb1753b821a4bbbd8a10a8f596530545dcc08d07f073
-
SSDEEP
196608:skb9iGGe4y2L43jn8dJkee9Cam6rMupEvE793ETQeeB2b4oRGLdQFb:Vb9ieT2LVTam6rD9UU/loRGLu5
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MenuExtendido.exe"C:\Users\Admin\AppData\Local\Temp\MenuExtendido.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x464 0x3441⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD5652b2e10ac3c23416c4418a50cc43095
SHA1f8ac5f2535cce84cc16c6b4410fb0885604ffc04
SHA256dca9f90340d5ff29288dbfbb3a9c79616fb4baa013e7dbe14ec071733de045fc
SHA512bb406b3f10d678e773499edbc949f49bd138e6742f1ac31bf0a50f8d3b42383580b5aceb0155625d6bad5074e577994938e109f94cd921769270aaa0b1a5f301
-
Filesize
960KB
-
Filesize
25.0MB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
960KB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
960KB
-
Filesize
25.0MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB
-
Filesize
25.0MB