quasar | f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12

Virtualization/Sandbox Evasion

T1497

Processes:

photo_protected.exe$77setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	photo_protected.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	$77setup.exe

Executes dropped EXE 2 IoCs

Processes:

photo_protected.exe$77setup.exe

pid process

1676 photo_protected.exe
2704 $77setup.exe

pid	process
1676	photo_protected.exe
2704	$77setup.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

$77setup.exephoto_protected.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	$77setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	photo_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	photo_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	$77setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\photo_protected.exe	themida
behavioral2/memory/1676-139-0x0000000000820000-0x00000000028EA000-memory.dmp	themida
behavioral2/memory/1676-140-0x0000000000820000-0x00000000028EA000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\photo_protected.exe	themida
C:\Windows\SysWOW64\$77\$77setup.exe	themida
behavioral2/memory/2704-159-0x0000000000F20000-0x0000000002FEA000-memory.dmp	themida
behavioral2/memory/2704-161-0x0000000000F20000-0x0000000002FEA000-memory.dmp	themida
C:\Windows\SysWOW64\$77\$77setup.exe	themida

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

photo_protected.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	photo_protected.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	photo_protected.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

photo_protected.exe$77setup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	photo_protected.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	$77setup.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 ip-api.com
Drops file in System32 directory 1 IoCs

Processes:

photo_protected.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\$77\$77setup.exe photo_protected.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

photo_protected.exe$77setup.exe

pid process

1676 photo_protected.exe
2704 $77setup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1660 2704 WerFault.exe $77setup.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4136 schtasks.exe
836 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5076 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

4260 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

photo_protected.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1676 photo_protected.exe
Token: SeDebugPrivilege 4260 powershell.exe

flow	ioc
22	ip-api.com

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\$77\$77setup.exe	photo_protected.exe

pid	process
1676	photo_protected.exe
2704	$77setup.exe

pid	pid_target	process	target process
1660	2704	WerFault.exe	$77setup.exe

pid	process
4136	schtasks.exe
836	schtasks.exe

pid	process
5076	PING.EXE

pid	process
4260	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1676	photo_protected.exe
Token: SeDebugPrivilege	4260	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exephoto_protected.exe

description	pid	process	target process
PID 1952 wrote to memory of 1676	1952	f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe	photo_protected.exe
PID 1952 wrote to memory of 1676	1952	f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe	photo_protected.exe
PID 1952 wrote to memory of 1676	1952	f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe	photo_protected.exe
PID 1676 wrote to memory of 4136	1676	photo_protected.exe	schtasks.exe
PID 1676 wrote to memory of 4136	1676	photo_protected.exe	schtasks.exe
PID 1676 wrote to memory of 4136	1676	photo_protected.exe	schtasks.exe
PID 1676 wrote to memory of 2704	1676	photo_protected.exe	$77setup.exe
PID 1676 wrote to memory of 2704	1676	photo_protected.exe	$77setup.exe
PID 1676 wrote to memory of 2704	1676	photo_protected.exe	$77setup.exe
PID 1676 wrote to memory of 4260	1676	photo_protected.exe	powershell.exe
PID 1676 wrote to memory of 4260	1676	photo_protected.exe	powershell.exe
PID 1676 wrote to memory of 4260	1676	photo_protected.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe
"C:\Users\Admin\AppData\Local\Temp\f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Users\Admin\AppData\Local\Temp\photo_protected.exe
  "C:\Users\Admin\AppData\Local\Temp\photo_protected.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "drivers" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\photo_protected.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4136
- - C:\Windows\SysWOW64\$77\$77setup.exe
    "C:\Windows\SysWOW64\$77\$77setup.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2704
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "drivers" /sc ONLOGON /tr "C:\Windows\SysWOW64\$77\$77setup.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2shrzu6T7s4q.bat" "
      4⤵
      PID:3640
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4536
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:5076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 1660
      4⤵
      Program crash
      PID:1660
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2704 -ip 2704
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

Scheduled Task

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

3

Remote System Discovery

T1018

System Information Discovery

4

Virtualization/Sandbox Evasion