quasar | f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12

Virtualization/Sandbox Evasion

T1497

Processes:

photo_protected.exe$77setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	photo_protected.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	$77setup.exe

Executes dropped EXE 2 IoCs

Processes:

photo_protected.exe$77setup.exe

pid process

1676 photo_protected.exe
2704 $77setup.exe

pid	process
1676	photo_protected.exe
2704	$77setup.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

$77setup.exephoto_protected.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	$77setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	photo_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	photo_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	$77setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\photo_protected.exe	themida
behavioral2/memory/1676-139-0x0000000000820000-0x00000000028EA000-memory.dmp	themida
behavioral2/memory/1676-140-0x0000000000820000-0x00000000028EA000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\photo_protected.exe	themida
C:\Windows\SysWOW64\$77\$77setup.exe	themida
behavioral2/memory/2704-159-0x0000000000F20000-0x0000000002FEA000-memory.dmp	themida
behavioral2/memory/2704-161-0x0000000000F20000-0x0000000002FEA000-memory.dmp	themida
C:\Windows\SysWOW64\$77\$77setup.exe	themida

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

photo_protected.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	photo_protected.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	photo_protected.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

photo_protected.exe$77setup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	photo_protected.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	$77setup.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 ip-api.com
Drops file in System32 directory 1 IoCs

Processes:

photo_protected.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\$77\$77setup.exe photo_protected.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

photo_protected.exe$77setup.exe

pid process

1676 photo_protected.exe
2704 $77setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1660 2704 WerFault.exe $77setup.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4136 schtasks.exe
836 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5076 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

4260 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

photo_protected.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1676 photo_protected.exe
Token: SeDebugPrivilege 4260 powershell.exe

flow	ioc
22	ip-api.com

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\$77\$77setup.exe	photo_protected.exe

pid	process
1676	photo_protected.exe
2704	$77setup.exe

pid	pid_target	process	target process
1660	2704	WerFault.exe	$77setup.exe

pid	process
4136	schtasks.exe
836	schtasks.exe

pid	process
5076	PING.EXE

pid	process
4260	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1676	photo_protected.exe
Token: SeDebugPrivilege	4260	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exephoto_protected.exe

description	pid	process	target process
PID 1952 wrote to memory of 1676	1952	f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe	photo_protected.exe
PID 1952 wrote to memory of 1676	1952	f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe	photo_protected.exe
PID 1952 wrote to memory of 1676	1952	f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe	photo_protected.exe
PID 1676 wrote to memory of 4136	1676	photo_protected.exe	schtasks.exe
PID 1676 wrote to memory of 4136	1676	photo_protected.exe	schtasks.exe
PID 1676 wrote to memory of 4136	1676	photo_protected.exe	schtasks.exe
PID 1676 wrote to memory of 2704	1676	photo_protected.exe	$77setup.exe
PID 1676 wrote to memory of 2704	1676	photo_protected.exe	$77setup.exe
PID 1676 wrote to memory of 2704	1676	photo_protected.exe	$77setup.exe
PID 1676 wrote to memory of 4260	1676	photo_protected.exe	powershell.exe
PID 1676 wrote to memory of 4260	1676	photo_protected.exe	powershell.exe
PID 1676 wrote to memory of 4260	1676	photo_protected.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe
"C:\Users\Admin\AppData\Local\Temp\f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\photo_protected.exe
"C:\Users\Admin\AppData\Local\Temp\photo_protected.exe"
2⤵
- Modifies Windows Defender Real-time Protection settings
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "drivers" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\photo_protected.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:4136

C:\Windows\SysWOW64\$77\$77setup.exe
"C:\Windows\SysWOW64\$77\$77setup.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2704

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "drivers" /sc ONLOGON /tr "C:\Windows\SysWOW64\$77\$77setup.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2shrzu6T7s4q.bat" "
4⤵
PID:3640

C:\Windows\SysWOW64\chcp.com
chcp 65001
5⤵
PID:4536

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
5⤵
- Runs ping.exe
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 1660
4⤵
- Program crash
PID:1660

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2704 -ip 2704
1⤵
PID:4044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

2

T1112

Disabling Security Tools

2

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

3

Virtualization/Sandbox Evasion

T1497

System Information Discovery

4

Remote System Discovery