Analysis
-
max time kernel
59s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 10:47
Behavioral task
behavioral1
Sample
FuckMeDaddy.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
FuckMeDaddy.exe
Resource
win10v2004-20230220-en
General
-
Target
FuckMeDaddy.exe
-
Size
4.2MB
-
MD5
220ff1ba3a62c1196e59b73315ce2cce
-
SHA1
60a0e81e130f519f87fef859c0f69fec338e30d6
-
SHA256
7edb45e51d05406adac04d2b0f00426b5f072127629a463084e4c105291620d4
-
SHA512
1bafa76c9d4e5d744d47e5128b7ffa9dd4696481ee5a4dafa031e6654517617d4e61c9df987123005f78b0e4d314c060354dd00d2c526c8a69f068d4bbabea12
-
SSDEEP
98304:cVZAL6CpWiZVYvyLM2Fu13UtPTF2iGdrS+GSed:iZAWqZ7LM2FulUybhSZt
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
FuckMeDaddy.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ FuckMeDaddy.exe -
Drops file in Drivers directory 1 IoCs
Processes:
FuckMeDaddy.exedescription ioc process File created C:\Windows\system32\drivers\NTIOLib_X64.sys FuckMeDaddy.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
FuckMeDaddy.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NTIOLib_MysticLight\ImagePath = "\\??\\C:\\Windows\\system32\\drivers\\NTIOLib_X64.sys" FuckMeDaddy.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
FuckMeDaddy.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion FuckMeDaddy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FuckMeDaddy.exe -
Processes:
resource yara_rule behavioral2/memory/1160-133-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmp themida behavioral2/memory/1160-138-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmp themida behavioral2/memory/1160-139-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmp themida behavioral2/memory/1160-142-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmp themida behavioral2/memory/1160-143-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmp themida behavioral2/memory/1160-144-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmp themida behavioral2/memory/1160-164-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmp themida behavioral2/memory/1160-169-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmp themida -
Processes:
FuckMeDaddy.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FuckMeDaddy.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
taskmgr.exepid process 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
FuckMeDaddy.exepid process 1160 FuckMeDaddy.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
FuckMeDaddy.exetaskmgr.exedescription pid process Token: SeLoadDriverPrivilege 1160 FuckMeDaddy.exe Token: SeDebugPrivilege 3616 taskmgr.exe Token: SeSystemProfilePrivilege 3616 taskmgr.exe Token: SeCreateGlobalPrivilege 3616 taskmgr.exe Token: 33 3616 taskmgr.exe Token: SeIncBasePriorityPrivilege 3616 taskmgr.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
Processes:
taskmgr.exepid process 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe -
Suspicious use of SendNotifyMessage 38 IoCs
Processes:
taskmgr.exepid process 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe 3616 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
FuckMeDaddy.exedescription pid process target process PID 1160 wrote to memory of 3344 1160 FuckMeDaddy.exe cmd.exe PID 1160 wrote to memory of 3344 1160 FuckMeDaddy.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FuckMeDaddy.exe"C:\Users\Admin\AppData\Local\Temp\FuckMeDaddy.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1160-164-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmpFilesize
10.5MB
-
memory/1160-135-0x0000000180000000-0x0000000180006000-memory.dmpFilesize
24KB
-
memory/1160-138-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmpFilesize
10.5MB
-
memory/1160-139-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmpFilesize
10.5MB
-
memory/1160-140-0x00007FFD00000000-0x00007FFD00002000-memory.dmpFilesize
8KB
-
memory/1160-141-0x00007FFD00030000-0x00007FFD00031000-memory.dmpFilesize
4KB
-
memory/1160-142-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmpFilesize
10.5MB
-
memory/1160-143-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmpFilesize
10.5MB
-
memory/1160-144-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmpFilesize
10.5MB
-
memory/1160-150-0x00007FF7F6CA0000-0x00007FF7F6CA1000-memory.dmpFilesize
4KB
-
memory/1160-133-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmpFilesize
10.5MB
-
memory/1160-169-0x00007FF7F6CB0000-0x00007FF7F7731000-memory.dmpFilesize
10.5MB
-
memory/3616-151-0x000002CAE7250000-0x000002CAE7251000-memory.dmpFilesize
4KB
-
memory/3616-157-0x000002CAE7250000-0x000002CAE7251000-memory.dmpFilesize
4KB
-
memory/3616-158-0x000002CAE7250000-0x000002CAE7251000-memory.dmpFilesize
4KB
-
memory/3616-159-0x000002CAE7250000-0x000002CAE7251000-memory.dmpFilesize
4KB
-
memory/3616-160-0x000002CAE7250000-0x000002CAE7251000-memory.dmpFilesize
4KB
-
memory/3616-161-0x000002CAE7250000-0x000002CAE7251000-memory.dmpFilesize
4KB
-
memory/3616-162-0x000002CAE7250000-0x000002CAE7251000-memory.dmpFilesize
4KB
-
memory/3616-163-0x000002CAE7250000-0x000002CAE7251000-memory.dmpFilesize
4KB
-
memory/3616-153-0x000002CAE7250000-0x000002CAE7251000-memory.dmpFilesize
4KB
-
memory/3616-152-0x000002CAE7250000-0x000002CAE7251000-memory.dmpFilesize
4KB