5de218dd00c5b6536a8ea373bbe9b9f2079f788a113b847fbd5c39932170a6e6

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
Size

8.5MB
MD5

772686c5dae13bb239cff557ad2ba438
SHA1

41fddf88a72223ddd0dbd7cb0cf3f4efb7b73d85
SHA256

d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76
SHA512

60de0c4cf3757c8f26241e8484c8f1255ad925a93f91c006b25ece59d3b83e8be20ab2ef6115cc351bc8e22302c7ba8540c17e1a7d1d073ac3c94d6d297307a9
SSDEEP

196608:jxSZrxSZExSZfU+2at3DS7sJav43YmOZdqUW8wvuube:jxSZrxSZExSZfU+2aJDSgJnmqxHvbbe

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Executes dropped EXE 1 IoCs

pid	Process
2844	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Loads dropped DLL 1 IoCs

pid	Process
2836	cmd.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2952	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2404	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2836	2404	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe	32
PID 2404 wrote to memory of 2836	2404	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe	32
PID 2404 wrote to memory of 2836	2404	d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe	32
PID 2836 wrote to memory of 2952	2836	cmd.exe	34
PID 2836 wrote to memory of 2952	2836	cmd.exe	34
PID 2836 wrote to memory of 2952	2836	cmd.exe	34
PID 2836 wrote to memory of 2844	2836	cmd.exe	35
PID 2836 wrote to memory of 2844	2836	cmd.exe	35
PID 2836 wrote to memory of 2844	2836	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
"C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe
    "C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe" relaunch
    3⤵
    - Executes dropped EXE
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe.bat

Filesize
495B

MD5
78ccae7620b686454c79ce57367e1827

SHA1
909ab79a0c9bb13284fdaafb99248ec20618d440

SHA256
654968eb88e87162dd1783efeab43caaca5c135db39e5d1065f683a7345804a9

SHA512
710660503cab10f00026e8a22c6109885a69dedba7d3f421467e511ef81949f75e6008aa56f2abf1ddbd116a853445f00719d065968d4eb4e76b144ad1ac3280

Download Submit
C:\Users\Admin\AppData\Local\Temp\d1a62cde3f49e619203ecf47cdef2cb02a768451ece298279ccf098016885b76.exe.tmp

Filesize
8.7MB

MD5
20e5a5e0b2e5fa41ab4450ca44aa083b

SHA1
392a148b38c092ccdc5b8c1cd8121c593b02fdf9

SHA256
901c11beb9bc214e349f4d5624e7399912fdadaef5c4da6a396fcc4db9b29fbf

SHA512
03dc250840902a89651facfb1b240a894e50e01e69b6d56d6f6c783c431b61fdc8af7841a9fab5760e4e2b2424abd320a7654757e8ae2c68e517cd763e28e88b

Download Submit
memory/2404-4-0x0000000000670000-0x0000000000684000-memory.dmp

Filesize
80KB

Download
memory/2404-2-0x000000001BA50000-0x000000001BB9E000-memory.dmp

Filesize
1.3MB

Download
memory/2404-0-0x000007FEF5EB3000-0x000007FEF5EB4000-memory.dmp

Filesize
4KB

Download
memory/2404-5-0x000000001CBC0000-0x000000001CF96000-memory.dmp

Filesize
3.8MB

Download
memory/2404-6-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2404-8-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2404-7-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2404-3-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2404-18-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2404-20-0x000007FEF5EB0000-0x000007FEF689C000-memory.dmp

Filesize
9.9MB

Download
memory/2404-1-0x0000000000F90000-0x00000000016A0000-memory.dmp

Filesize
7.1MB

Download
memory/2844-24-0x000007FEF54C3000-0x000007FEF54C4000-memory.dmp

Filesize
4KB

Download
memory/2844-25-0x0000000000A30000-0x0000000001140000-memory.dmp

Filesize
7.1MB

Download
memory/2844-26-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download
memory/2844-27-0x000007FEF54C3000-0x000007FEF54C4000-memory.dmp

Filesize
4KB

Download
memory/2844-28-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download