Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 00:17
General
-
Target
75707ae37316328f661e00cf9c813def7a0a3aef1b017b4a326032bf7d60a325.exe
-
Size
2.5MB
-
MD5
1032aa0f426642fc4b4d4dd97c2524b1
-
SHA1
c436fe6edf2190ad194851c53a2092a60483a184
-
SHA256
75707ae37316328f661e00cf9c813def7a0a3aef1b017b4a326032bf7d60a325
-
SHA512
409f94180cc5bc161a47676b78d18ea51be4babb568efbcac445cb1a885fb2b8d02d326e713da14c6875e88057f40166de7470f0bc59a150ef02a1ea96d75362
-
SSDEEP
49152:XxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxL:Xxx9NUFkQx753uWuCyyxL
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 18 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75707ae37316328f661e00cf9c813def7a0a3aef1b017b4a326032bf7d60a325.exe"C:\Users\Admin\AppData\Local\Temp\75707ae37316328f661e00cf9c813def7a0a3aef1b017b4a326032bf7d60a325.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD567b56b9b1ceba2b99c556cff4901bcc4
SHA154b98eba29e5ca792ae38c34e3ef911cffe9ac79
SHA25607513df6c3dd45a25ba38e3fbaf551b1607cc0f2d205428cd0b77ecb732c3547
SHA512adf4fa5bd6d2cea3d50e6455628ee0da223b4cf3824a3bc9a03bbe7f88f410496623b30a3f46af6c9eb346cc1c5062c25d03d25b1455b75ef25a13e679215696
-
Filesize
2.5MB
MD57a6fee1940cb854bc9381297576d1e2e
SHA196b127fdd37405bb088982fb964e4dcc3a2e7cac
SHA2569160d1c672bc5970c2a6560060f2abb878076502edfd17bdc292aea4fe4ca113
SHA512bf5c22ae7a219f795e213511b6c20730fbe9cfe9700c81c5341d17d43f304f738f7c9124997041ef6aeb40503112364fcc6433f0a548a8d32252084aa35eb5ce
-
Filesize
2.5MB
MD56852dc213a26a35128c38099ff2e1270
SHA1c25481bd2f5ccf2d0d1686cb831c96b356ef995d
SHA2560ce0228a6fb48ce4e4bf7885a8b5193fa61cc698fc6917a951ad1fcf88a1634e
SHA512c1010de16f2cf2e86ae70448eeaa2c407df3d18681cb87c64dda635c78dceb2678355069f29828cb27ab9f646467cd36ef073ae2896f3a5e4c5e6646df5b7395
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB