5de218dd00c5b6536a8ea373bbe9b9f2079f788a113b847fbd5c39932170a6e6

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
Size

8.5MB
MD5

772686c5dae13bb239cff557ad2ba438
SHA1

41fddf88a72223ddd0dbd7cb0cf3f4efb7b73d85
SHA256

d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76
SHA512

60de0c4cf3757c8f26241e8484c8f1255ad925a93f91c006b25ece59d3b83e8be20ab2ef6115cc351bc8e22302c7ba8540c17e1a7d1d073ac3c94d6d297307a9
SSDEEP

196608:jxSZrxSZExSZfU+2at3DS7sJav43YmOZdqUW8wvuube:jxSZrxSZExSZfU+2aJDSgJnmqxHvbbe

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Executes dropped EXE 1 IoCs

pid	Process
532	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Loads dropped DLL 1 IoCs

pid	Process
2592	cmd.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2988	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2736	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2592	2736	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe	31
PID 2736 wrote to memory of 2592	2736	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe	31
PID 2736 wrote to memory of 2592	2736	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe	31
PID 2592 wrote to memory of 2988	2592	cmd.exe	33
PID 2592 wrote to memory of 2988	2592	cmd.exe	33
PID 2592 wrote to memory of 2988	2592	cmd.exe	33
PID 2592 wrote to memory of 532	2592	cmd.exe	34
PID 2592 wrote to memory of 532	2592	cmd.exe	34
PID 2592 wrote to memory of 532	2592	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
"C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2988
- - C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
    "C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe" relaunch
    3⤵
    - Executes dropped EXE
    PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe.bat

Filesize
495B

MD5
78ccae7620b686454c79ce57367e1827

SHA1
909ab79a0c9bb13284fdaafb99248ec20618d440

SHA256
654968eb88e87162dd1783efeab43caaca5c135db39e5d1065f683a7345804a9

SHA512
710660503cab10f00026e8a22c6109885a69dedba7d3f421467e511ef81949f75e6008aa56f2abf1ddbd116a853445f00719d065968d4eb4e76b144ad1ac3280

Download Submit
C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe.tmp

Filesize
8.7MB

MD5
2dd19d05384da124ec177fb8057c32eb

SHA1
eb972a40e359c0b01824dfe7b2c7273a3944d9ff

SHA256
64ea59445c4d9e9505127ec53f8821525559663d16804c211bc6b8bc599f9fa1

SHA512
4786a08cd2d19becfef335b3e105b66ec3ca71c2029e260764ad7a5353a4b4b6fe87ca153975810511f64cf0b01287cfb03f1802a45929fc417aecdbe5393f74

Download Submit
memory/532-28-0x000007FEF4A40000-0x000007FEF542C000-memory.dmp

Filesize
9.9MB

Download
memory/532-27-0x000007FEF4A43000-0x000007FEF4A44000-memory.dmp

Filesize
4KB

Download
memory/532-26-0x00000000006E0000-0x00000000006F4000-memory.dmp

Filesize
80KB

Download
memory/532-25-0x000007FEF4A40000-0x000007FEF542C000-memory.dmp

Filesize
9.9MB

Download
memory/532-24-0x0000000000BC0000-0x00000000012D0000-memory.dmp

Filesize
7.1MB

Download
memory/2736-4-0x00000000005F0000-0x0000000000604000-memory.dmp

Filesize
80KB

Download
memory/2736-8-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-7-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-18-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-20-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-6-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-5-0x000000001CA60000-0x000000001CE36000-memory.dmp

Filesize
3.8MB

Download
memory/2736-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/2736-3-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-2-0x000000001C4C0000-0x000000001C60E000-memory.dmp

Filesize
1.3MB

Download
memory/2736-1-0x0000000000D30000-0x0000000001440000-memory.dmp

Filesize
7.1MB

Download