Analysis
-
max time kernel
149s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-03-2023 19:59
Behavioral task
behavioral1
Sample
Growpai.dll
Resource
win7-20230220-en
windows7-x64
10 signatures
150 seconds
General
-
Target
Growpai.dll
-
Size
4.8MB
-
MD5
7f3c2aed44eb710ed0f624f3d4bb665e
-
SHA1
8389c33e975681201900eab75b4d8d34fca52000
-
SHA256
b08d00a9eba33a30059541904152d59655c7354316966fdd58090aae59958dd3
-
SHA512
82fa8eefb4d9086bab8995d4586f73022f4e90170b1f758909f2c6d564c82f35e12fcda6aa1b514c0ea2d21ef356376a1229aae71217a591194eb3b015c7c115
-
SSDEEP
98304:4FSydiu3WTYUHPFH7DKIE0hTBs4hQl2aRa5pi8SS0B71pi:40RxTBHPJDKPqBs4CR2ES0Bi
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/1976-54-0x000007FEF4730000-0x000007FEF53A2000-memory.dmp themida behavioral1/memory/1976-55-0x000007FEF4730000-0x000007FEF53A2000-memory.dmp themida behavioral1/memory/1976-56-0x000007FEF4730000-0x000007FEF53A2000-memory.dmp themida behavioral1/memory/1976-57-0x000007FEF4730000-0x000007FEF53A2000-memory.dmp themida behavioral1/memory/1976-60-0x000007FEF4730000-0x000007FEF53A2000-memory.dmp themida behavioral1/memory/1976-63-0x000007FEF4730000-0x000007FEF53A2000-memory.dmp themida -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 1976 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1500 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 1500 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe 1500 taskmgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Growpai.dll,#11⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1500-64-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1500-65-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1500-66-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1500-67-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1976-54-0x000007FEF4730000-0x000007FEF53A2000-memory.dmpFilesize
12.4MB
-
memory/1976-55-0x000007FEF4730000-0x000007FEF53A2000-memory.dmpFilesize
12.4MB
-
memory/1976-56-0x000007FEF4730000-0x000007FEF53A2000-memory.dmpFilesize
12.4MB
-
memory/1976-57-0x000007FEF4730000-0x000007FEF53A2000-memory.dmpFilesize
12.4MB
-
memory/1976-59-0x000007FEF53B0000-0x000007FEF6022000-memory.dmpFilesize
12.4MB
-
memory/1976-60-0x000007FEF4730000-0x000007FEF53A2000-memory.dmpFilesize
12.4MB
-
memory/1976-62-0x000007FEF53B0000-0x000007FEF6022000-memory.dmpFilesize
12.4MB
-
memory/1976-63-0x000007FEF4730000-0x000007FEF53A2000-memory.dmpFilesize
12.4MB