50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea

Analysis

max time kernel
152s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2023 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
Size

5.3MB
MD5

ad32d713f0182e55ecd7315d7871022f
SHA1

37cfea0d8f107a6ac1c9f914fcc1ebd0aa836528
SHA256

50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea
SHA512

ba60a94b247ecbd72f67d04f8f9efd70d0291c120d913adfecbafb0e401d346b29f5f4512d7f324bb052de3b295e200b6cc8d37ccfa28a91c97852f451a4e76c
SSDEEP

98304:XE6uXxJ1O9eBLWsv7XDcXMDvViTUKWG+qQqN0HcMhQwV/ydnC5+vh0lmwU5cluh:6XxM0LWsv08DvViTUC4pzyYMKlmxiluh

Score

9^/10

evasion persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe

Themida packer 31 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/5040-0-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-2-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-3-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-4-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-5-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-6-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-7-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-8-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-9-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-10-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-32-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-36-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-37-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-38-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-39-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-42-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-43-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-44-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-47-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/4968-48-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/4968-49-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/4968-50-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/4968-51-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/4968-52-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/4968-53-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/4968-54-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/4968-55-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/4968-56-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/4968-57-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/5040-77-0x0000000000790000-0x00000000014AF000-memory.dmp	themida
behavioral2/memory/4968-78-0x0000000000790000-0x00000000014AF000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CareUEyes = "C:\\Users\\Admin\\AppData\\Local\\Temp\\50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe /tray"	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
4968	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\WOW6432Node\CLSID\{FC36FD6A-7586-4ad1-8CBF-EB8AB7A51533}	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\WOW6432Node\CLSID\{FC36FD6A-7586-4ad1-8CBF-EB8AB7A51533}\uuid = "MmFjMTljYThhY2FkNGY2MmU4ZDZkNTQ5ZWVhZWE3NjY="	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\WOW6432Node\CLSID\{FC36FD6A-7586-4ad1-8CBF-EB8AB7A51533}	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
4968	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
4968	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4968	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
4968	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4968	5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe	94
PID 5040 wrote to memory of 4968	5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe	94
PID 5040 wrote to memory of 4968	5040	50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe	94

C:\Users\Admin\AppData\Local\Temp\50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
"C:\Users\Admin\AppData\Local\Temp\50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe
  "C:\Users\Admin\AppData\Local\Temp\50d317df8397ffe82d01a6720af0074a85f4568b7941ed9c9eb331c07a6b65ea.exe" /tj
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\careueyes\setting_v2.dat

Filesize
2KB

MD5
f5d81fe8abd3c7484544546a7d365eb7

SHA1
472fc8e93b6d8bde64cc2c09fcabc20caa146dd0

SHA256
75ff7690d2f9055e6839d112193168352e4791669f1e445a0e46fae589f05ccb

SHA512
6ffcfcd595dba4872d3d8f92497ce0c64ee327e68f99b6387c7ddedb427b98d62448f8b769c7348419dee0c7f2cfdd272b5787ac718081d2efa47934a75fc91b

Download Submit
C:\Users\Admin\AppData\Roaming\careueyes\setting_v2.dat

Filesize
2KB

MD5
cff38c4df13c9af79b05395419ac5a93

SHA1
502ab581407a07558b77520738a32c215b43eb54

SHA256
f104b2d54740569d6473875504d0c954a76e65f2f0ce3c21150a4d8af9a94d15

SHA512
74ac1242af261e3ed92ce9c3fc2bd6b6b834540cf6ddfe3d5634cf5eca2b3a062ddd2b8dc0f6f776ba3276959080ef83bfec6600e9c1247d8b462d119ddc7c45

Download Submit
memory/4968-55-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/4968-61-0x00000000016C0000-0x00000000016D0000-memory.dmp

Filesize
64KB

Download
memory/4968-57-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/4968-56-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/4968-48-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/4968-54-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/4968-53-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/4968-52-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/4968-51-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/4968-50-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/4968-49-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/4968-78-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-9-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-12-0x0000000003CD0000-0x0000000003CE0000-memory.dmp

Filesize
64KB

Download
memory/5040-36-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-37-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-38-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-39-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-42-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-43-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-44-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-47-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-32-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-35-0x0000000003CD0000-0x0000000003CE0000-memory.dmp

Filesize
64KB

Download
memory/5040-11-0x0000000036220000-0x0000000036230000-memory.dmp

Filesize
64KB

Download
memory/5040-10-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-0-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-8-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-7-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-6-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-5-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-4-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-3-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-2-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-77-0x0000000000790000-0x00000000014AF000-memory.dmp

Filesize
13.1MB

Download
memory/5040-1-0x0000000077944000-0x0000000077946000-memory.dmp

Filesize
8KB

Download