5c63933553e1452d634beb2b295333e4db5742e571322d823648d4e5c94b2828

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe
Size

8.8MB
MD5

81b063116bb27dc9ce34885c7e52536f
SHA1

596f067c80e5bb03298c90529b0890236c936130
SHA256

8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262
SHA512

7bc8d106498dfbe1f1679c94e0ab0fc112bdced14cb690deb2a1c8cb69e414a252e1cf70a902711ec03bab037520ce3bca9da3f57c16e1c9faa2f56f44632b86
SSDEEP

196608:jxSZrxSZExSZfU+2at3DS7sJav43YmOZdqUJ9quict4Z6XfspX:jxSZrxSZExSZfU+2aJDSgJnmqukY4ZoO

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe

Executes dropped EXE 1 IoCs

pid	Process
2520	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe

Loads dropped DLL 1 IoCs

pid	Process
2676	cmd.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2780	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2948	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2676	2948	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe	31
PID 2948 wrote to memory of 2676	2948	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe	31
PID 2948 wrote to memory of 2676	2948	8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe	31
PID 2676 wrote to memory of 2780	2676	cmd.exe	33
PID 2676 wrote to memory of 2780	2676	cmd.exe	33
PID 2676 wrote to memory of 2780	2676	cmd.exe	33
PID 2676 wrote to memory of 2520	2676	cmd.exe	34
PID 2676 wrote to memory of 2520	2676	cmd.exe	34
PID 2676 wrote to memory of 2520	2676	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe
"C:\Users\Admin\AppData\Local\Temp\8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe
    "C:\Users\Admin\AppData\Local\Temp\8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe" relaunch
    3⤵
    - Executes dropped EXE
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe.bat

Filesize
495B

MD5
4d7137bbb0196bf823e6b40da0a7cb16

SHA1
53922ada71eb1865da6217b3588752cb15c17d1f

SHA256
b3cdc832579353fd229ef028b9a4a6dd1e4b3ef3aea8f5cb76c9e1c3a791ff14

SHA512
48c1262c9573e92e87d0cb61efdb19829bb656c4323a0cca7ef5336af4bcfa189d038e685a35791a00f610e00cb12fcb963a3ba0b1b70ecc3fdd37d27bf7b3ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\8032ddd61456915a71fc5f5f409f6190321e3b74630fcec428612f9ba0995262.exe.tmp

Filesize
8.9MB

MD5
0e4f6766d98332daca67fbcf128e3f2e

SHA1
3e9b70d590ecfe92b8dcc66399e2d070ea021bb4

SHA256
e34a00f1ad082e0e6713f2b23c5eb4c88e8bcdd146deefb93c3421d1c0632ae2

SHA512
f58964a7f1595c04bd4ce0cadc2f331e0454ffdfdab0a5cd0b70c3d26d39afe642f4f60a4f6425db5642099a3a6fd92c19649b6d2823230552f8a860b42f61a7

Download Submit
memory/2520-28-0x000007FEF5CC0000-0x000007FEF66AC000-memory.dmp

Filesize
9.9MB

Download
memory/2520-27-0x000007FEF5CC3000-0x000007FEF5CC4000-memory.dmp

Filesize
4KB

Download
memory/2520-25-0x0000000000870000-0x0000000000884000-memory.dmp

Filesize
80KB

Download
memory/2520-26-0x000007FEF5CC0000-0x000007FEF66AC000-memory.dmp

Filesize
9.9MB

Download
memory/2520-24-0x0000000001120000-0x0000000001830000-memory.dmp

Filesize
7.1MB

Download
memory/2948-5-0x000000001CE40000-0x000000001D216000-memory.dmp

Filesize
3.8MB

Download
memory/2948-8-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-7-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-18-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-20-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-6-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-2-0x000000001C720000-0x000000001C86E000-memory.dmp

Filesize
1.3MB

Download
memory/2948-0-0x000007FEF66B3000-0x000007FEF66B4000-memory.dmp

Filesize
4KB

Download
memory/2948-4-0x0000000000570000-0x0000000000584000-memory.dmp

Filesize
80KB

Download
memory/2948-3-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-1-0x0000000000A00000-0x0000000001110000-memory.dmp

Filesize
7.1MB

Download