Analysis
-
max time kernel
119s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 16:15
General
-
Target
Infinit Script.exe
-
Size
10.4MB
-
MD5
abf8a77c489ba97e7d26fbc782168ace
-
SHA1
072e2b34895b65d8a84f670d1a8b75535934e326
-
SHA256
c0016afbcaaeae90bd6c926c2c74e2360380fa04ea99c3b095ad460813bb5ff7
-
SHA512
351b45d4b5a62b86f74c7ee6af8673cdc2771a497d8bf76c0de3a090f09a35e05fd81a666b9795ff5f76ae212a46ae2f870c14b9384c1e6c0a1e32d9f4f15812
-
SSDEEP
196608:5Ot+WBFec8gerzSRtUb26Xcsg6HF/Yg12N3mi0A/e1ZheiJ:5BKeHynNszl/Yg12NWi0AmVn
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Themida packer 7 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 24 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Infinit Script.exe"C:\Users\Admin\AppData\Local\Temp\Infinit Script.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ""C:\Users\Admin\Documents\W8Od9rHl\CFmkb.exe" "C:\Users\Admin\Documents\W8Od9rHl\p8gyn.sys""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\W8Od9rHl\CFmkb.exe"C:\Users\Admin\Documents\W8Od9rHl\CFmkb.exe" "C:\Users\Admin\Documents\W8Od9rHl\p8gyn.sys"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.7MB
MD589b62d57e6d670fdbbcd584b356a27c8
SHA12f97293f362e12a96db0fd6810047ea892d16a23
SHA25653d1516810c398e83e14c387987639b6bd3fbfe23698bbd2e86c52190e09fbd8
SHA5129d6565eec52e7b099def1387c4fc244af1ec32846f1cac9524c1d05e380ed57812f00b2b387c06010f1eb7a63fc6ff2ff92960a66820c90635007202aafb4f59
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
10.3MB
-
Filesize
8KB
-
Filesize
10.3MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
240KB
-
Filesize
1.3MB
-
Filesize
80KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
128KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
4.0MB
-
Filesize
9.6MB
-
Filesize
10.8MB
-
Filesize
10.5MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB