Analysis

  • max time kernel
    121s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:10

General

  • Target

    4b5d342b8c5a5b19fac86b1315802786.exe

  • Size

    8.7MB

  • MD5

    4b5d342b8c5a5b19fac86b1315802786

  • SHA1

    3566b77ecc01ef67839e91b542dab05434167495

  • SHA256

    865dc3b296ef4745577ad148b1ce7f9e812a32b8d020a09bd783fbd067750467

  • SHA512

    f74e6d947d3a3cad43a0c4b40bc33e7b3961cb3857fac18c139b686c75015d4ea5d7410fb5a833676e5d04c0d41b34cec9f618fb42cf52d75c36fe435f22ce32

  • SSDEEP

    196608:jxSZrxSZExSZfU+2at3DS7sJav43YmOZdqUJ9quict4Z6Xfs6:jxSZrxSZExSZfU+2aJDSgJnmqukY4ZoZ

Score
9/10

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b5d342b8c5a5b19fac86b1315802786.exe
    "C:\Users\Admin\AppData\Local\Temp\4b5d342b8c5a5b19fac86b1315802786.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\4b5d342b8c5a5b19fac86b1315802786.exe.bat" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Windows\system32\timeout.exe
        timeout /t 1 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:2960
      • C:\Users\Admin\AppData\Local\Temp\4b5d342b8c5a5b19fac86b1315802786.exe
        "C:\Users\Admin\AppData\Local\Temp\4b5d342b8c5a5b19fac86b1315802786.exe" relaunch
        3⤵
        • Executes dropped EXE
        PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4b5d342b8c5a5b19fac86b1315802786.exe.bat

    Filesize

    399B

    MD5

    1b6dd772d96cbffb8917c2c5feddeaca

    SHA1

    ee5d99ca7912720e1c4496833f1e9084b27091f3

    SHA256

    4cfd99a5af42bde2be7a4482eaa6e3c89fc41e0afb4fced39896045b3200faf2

    SHA512

    75afbaa98d204430158ed6dd271e6719846a1279a8ec59f98b3ddf61a9bf95d4782fcd93a28e9a6155213c8844823e958e321ef88c27b5032b545230f76dff94

  • C:\Users\Admin\AppData\Local\Temp\4b5d342b8c5a5b19fac86b1315802786.exe.tmp

    Filesize

    8.8MB

    MD5

    f559e50d1d353b5c27cd6e4523b0f1aa

    SHA1

    c97132dd3d118b6f7523604173d8196b20405d03

    SHA256

    8db132e04e24250fae058dadd33081fdc55f9b3e89524cfc745c19e89d003e15

    SHA512

    164665dda583cfa92eac917ca67ad2ce9df6a658fdcad6427b39a0f1261911084d750ea60973fa454a6725544f34a4630961f993bb8c2a8a80595281b61da689

  • memory/2080-8-0x000007FEF6BB0000-0x000007FEF759C000-memory.dmp

    Filesize

    9.9MB

  • memory/2080-9-0x000007FEF6BB0000-0x000007FEF759C000-memory.dmp

    Filesize

    9.9MB

  • memory/2080-4-0x0000000000770000-0x0000000000784000-memory.dmp

    Filesize

    80KB

  • memory/2080-5-0x000007FEF6BB3000-0x000007FEF6BB4000-memory.dmp

    Filesize

    4KB

  • memory/2080-6-0x000000001CBF0000-0x000000001CFC6000-memory.dmp

    Filesize

    3.8MB

  • memory/2080-7-0x000007FEF6BB0000-0x000007FEF759C000-memory.dmp

    Filesize

    9.9MB

  • memory/2080-0-0x000007FEF6BB3000-0x000007FEF6BB4000-memory.dmp

    Filesize

    4KB

  • memory/2080-3-0x000000001CAA0000-0x000000001CBEE000-memory.dmp

    Filesize

    1.3MB

  • memory/2080-2-0x000007FEF6BB0000-0x000007FEF759C000-memory.dmp

    Filesize

    9.9MB

  • memory/2080-12-0x000007FEF6BB0000-0x000007FEF759C000-memory.dmp

    Filesize

    9.9MB

  • memory/2080-21-0x000007FEF6BB0000-0x000007FEF759C000-memory.dmp

    Filesize

    9.9MB

  • memory/2080-1-0x0000000000DD0000-0x00000000014E0000-memory.dmp

    Filesize

    7.1MB

  • memory/2656-25-0x00000000003E0000-0x0000000000AF0000-memory.dmp

    Filesize

    7.1MB

  • memory/2656-26-0x000007FEF6CB0000-0x000007FEF769C000-memory.dmp

    Filesize

    9.9MB

  • memory/2656-27-0x000007FEF6CB3000-0x000007FEF6CB4000-memory.dmp

    Filesize

    4KB

  • memory/2656-28-0x000007FEF6CB0000-0x000007FEF769C000-memory.dmp

    Filesize

    9.9MB