Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 00:29
General
-
Target
75707ae37316328f661e00cf9c813def7a0a3aef1b017b4a326032bf7d60a325.exe
-
Size
2.5MB
-
MD5
1032aa0f426642fc4b4d4dd97c2524b1
-
SHA1
c436fe6edf2190ad194851c53a2092a60483a184
-
SHA256
75707ae37316328f661e00cf9c813def7a0a3aef1b017b4a326032bf7d60a325
-
SHA512
409f94180cc5bc161a47676b78d18ea51be4babb568efbcac445cb1a885fb2b8d02d326e713da14c6875e88057f40166de7470f0bc59a150ef02a1ea96d75362
-
SSDEEP
49152:XxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxL:Xxx9NUFkQx753uWuCyyxL
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Themida packer 17 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75707ae37316328f661e00cf9c813def7a0a3aef1b017b4a326032bf7d60a325.exe"C:\Users\Admin\AppData\Local\Temp\75707ae37316328f661e00cf9c813def7a0a3aef1b017b4a326032bf7d60a325.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD542a780aacfac7dcd03952c313c21b99d
SHA108ef01dd4e1c53026cbacc01a2c764d7c91b2953
SHA25647399e12ea8ce53eee09e7491dfb9682fdf63b906a2b41b43a1295107c3a9fd4
SHA5128682915408d3656a770946e48b06f57c6e670b5b83091d28c56f71014d91405f339e2c044a8450c03c2a188cf3d2e500fd55d974554bcfaa274cdcb053f7b503
-
Filesize
2.5MB
MD521040eff33dc052df0cf947639287d7c
SHA1ea87f2c8060479b31a8da12b11fc8461d0f1d00b
SHA256e0ea808bfb88a47ca4f47ec7124bd9d35b2db59788bc1662dbfc91ad4c70fcdb
SHA512dfd87153c2a9880f5811af64808b127451a9e9c834d9e28a03a344ae69b798f3f5b394d65603af5ee408409ac58dfafa0ca4f1cbede2c83c867efcdcf3d3f0c8
-
Filesize
2.5MB
MD5a54225db97683741416ec228fe7f55db
SHA162cf5db36321c98e6217fa28a438173c3593cda9
SHA256f0a10d1753156aa24bfdc91c22b2f3a1e37089c5e6d830153e2ad064db1b5669
SHA5128ff125a70ce579e74ceb970263fa230f44d1ac4069a8b2d218ca43398749ed808ca82be64a55a26497e291a94853d90ba9c2dd5958e478d93cc817ca7f68b034
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
8KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB