Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-11-2024 04:59
General
-
Target
e03b5e62ea80cff41079912cc5af436400a27f2a5a0dce7c94ace7088fb757c3.exe
-
Size
1.9MB
-
MD5
1bc8cda9144e1351ca43a0794a85f09c
-
SHA1
11f830cfdf67d4cb6a444259ac9f11399d53babd
-
SHA256
e03b5e62ea80cff41079912cc5af436400a27f2a5a0dce7c94ace7088fb757c3
-
SHA512
aa62c997a607f45bd258593600bb2cf7d6085fb37bd66f220f085ce995211e1d27d0280c2d061fd8551ec7ea58d65c35b9f175a976509ef6e684acaba7067a75
-
SSDEEP
49152:ISlNHydXboE+2pKWTvP6p9kB/GS0fsXCF8:ISjydNCYn0+d
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e03b5e62ea80cff41079912cc5af436400a27f2a5a0dce7c94ace7088fb757c3.exe"C:\Users\Admin\AppData\Local\Temp\e03b5e62ea80cff41079912cc5af436400a27f2a5a0dce7c94ace7088fb757c3.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5471d6afa5ad703cb351f798e8a8e5049
SHA1535b36e144438167836be09c1b5f1379dc4b5edb
SHA256400d59108ec6da4257cf11f0326478e566a6a3387883034ca2178058ea4daa98
SHA5126b11ba5f5352c786bb82ac962a9708eb4fe6fb0533995fe41c541fb7c7fd7ce657a1015b22a147923eacc754ee00670a9dcf6d01c2a0c0837f1ff27f24f3bf45
-
Filesize
1.9MB
MD5626f2f51c2baf18d90ef0692c8653864
SHA1ed332e399a5e155fc0329b5da58c23b52b99fc5f
SHA256fd496475a0df4b499fa297dc2858a97cd53b6ac4b718204f6c51b37dbace5b7a
SHA5126e8e98ef4065ef5d942274b6e3e61d10e3ed7cc35233df62efa2e3eb21043dfaab4d5221a913a22a2e47979151af20ff1aba0da80dfd611f55b9514e41a6fd9a
-
Filesize
1.9MB
MD533b9bf8efcf00db3821ad943967e6ac2
SHA1c41716885a6bd2b2254207a3b9f1b2e3421fe6fa
SHA256f43f589a4c8cdc09411dd30fecb6b8e9a0377c4fe1b40363791f81e8c9b61458
SHA5125dee0be14613b46afb74535913c0628a121cedf3beff291360db2b0cb1b6f77622899fbdb8b36c05408ca6a3fbda6a659bcf199b91f2daf19cf5783e0b19a789
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB