Analysis
-
max time kernel
44s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
11-08-2022 16:09
Behavioral task
behavioral1
Sample
Launcher.exe
Resource
win7-20220715-en
windows7-x64
9 signatures
150 seconds
General
-
Target
Launcher.exe
-
Size
3.7MB
-
MD5
26de3aeeabe0ae76f1018eaa2532f16a
-
SHA1
cb64725485be721627e11871cbb7fb6a778beb2d
-
SHA256
1492ef6536804555c64804636662313d4345fcf02d7d568c2cc291f221915ed7
-
SHA512
4b1ea404e601a3990ff2abf97c273c4a23205a30f5bdf2cc78706efcb3cfd7e20157fa9071cade58f39ce3206db56185ca523780fd16d167a2d6f3fd4e6eb118
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Launcher.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Launcher.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Launcher.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Launcher.exe -
Processes:
resource yara_rule behavioral1/memory/892-57-0x0000000000FD0000-0x00000000018FC000-memory.dmp themida behavioral1/memory/892-58-0x0000000000FD0000-0x00000000018FC000-memory.dmp themida -
Processes:
Launcher.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Launcher.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Launcher.exepid process 892 Launcher.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2024 892 WerFault.exe Launcher.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Launcher.exepid process 892 Launcher.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Launcher.exedescription pid process Token: SeDebugPrivilege 892 Launcher.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Launcher.exedescription pid process target process PID 892 wrote to memory of 2024 892 Launcher.exe WerFault.exe PID 892 wrote to memory of 2024 892 Launcher.exe WerFault.exe PID 892 wrote to memory of 2024 892 Launcher.exe WerFault.exe PID 892 wrote to memory of 2024 892 Launcher.exe WerFault.exe PID 892 wrote to memory of 2024 892 Launcher.exe WerFault.exe PID 892 wrote to memory of 2024 892 Launcher.exe WerFault.exe PID 892 wrote to memory of 2024 892 Launcher.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 15842⤵
- Program crash
PID:2024