Analysis
-
max time kernel
143s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
23-01-2024 16:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dsds.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
dsds.exe
-
Size
5.0MB
-
MD5
474d38f6d59f82af316a72ee7efa8e72
-
SHA1
3244eac1945521161b6cbe8f709057ec7d0c8713
-
SHA256
2af0b3e940318287fd085956389e9712bd436391081e437b09730de85a3e4807
-
SHA512
d3b593e300badfc6cf7e35bf244eb847498a822da20f108732d260e65cea26d442c6ca94503a04c10f38065eaedfabe98117c44aa769b50cfcc7e3999f7fc9a4
-
SSDEEP
98304:aOY73jt49ST9qmGhODTImdgYhdlAz6sKMyHpgtr9jtSuV1j6k/b7BGnp2AqV:aOi3JP1G4v9hrv7MgpgfZ1j6sBGHO
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ dsds.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion dsds.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion dsds.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dsds.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1412 WMIC.exe Token: SeSecurityPrivilege 1412 WMIC.exe Token: SeTakeOwnershipPrivilege 1412 WMIC.exe Token: SeLoadDriverPrivilege 1412 WMIC.exe Token: SeSystemProfilePrivilege 1412 WMIC.exe Token: SeSystemtimePrivilege 1412 WMIC.exe Token: SeProfSingleProcessPrivilege 1412 WMIC.exe Token: SeIncBasePriorityPrivilege 1412 WMIC.exe Token: SeCreatePagefilePrivilege 1412 WMIC.exe Token: SeBackupPrivilege 1412 WMIC.exe Token: SeRestorePrivilege 1412 WMIC.exe Token: SeShutdownPrivilege 1412 WMIC.exe Token: SeDebugPrivilege 1412 WMIC.exe Token: SeSystemEnvironmentPrivilege 1412 WMIC.exe Token: SeRemoteShutdownPrivilege 1412 WMIC.exe Token: SeUndockPrivilege 1412 WMIC.exe Token: SeManageVolumePrivilege 1412 WMIC.exe Token: 33 1412 WMIC.exe Token: 34 1412 WMIC.exe Token: 35 1412 WMIC.exe Token: 36 1412 WMIC.exe Token: SeIncreaseQuotaPrivilege 1412 WMIC.exe Token: SeSecurityPrivilege 1412 WMIC.exe Token: SeTakeOwnershipPrivilege 1412 WMIC.exe Token: SeLoadDriverPrivilege 1412 WMIC.exe Token: SeSystemProfilePrivilege 1412 WMIC.exe Token: SeSystemtimePrivilege 1412 WMIC.exe Token: SeProfSingleProcessPrivilege 1412 WMIC.exe Token: SeIncBasePriorityPrivilege 1412 WMIC.exe Token: SeCreatePagefilePrivilege 1412 WMIC.exe Token: SeBackupPrivilege 1412 WMIC.exe Token: SeRestorePrivilege 1412 WMIC.exe Token: SeShutdownPrivilege 1412 WMIC.exe Token: SeDebugPrivilege 1412 WMIC.exe Token: SeSystemEnvironmentPrivilege 1412 WMIC.exe Token: SeRemoteShutdownPrivilege 1412 WMIC.exe Token: SeUndockPrivilege 1412 WMIC.exe Token: SeManageVolumePrivilege 1412 WMIC.exe Token: 33 1412 WMIC.exe Token: 34 1412 WMIC.exe Token: 35 1412 WMIC.exe Token: 36 1412 WMIC.exe Token: SeIncreaseQuotaPrivilege 3976 WMIC.exe Token: SeSecurityPrivilege 3976 WMIC.exe Token: SeTakeOwnershipPrivilege 3976 WMIC.exe Token: SeLoadDriverPrivilege 3976 WMIC.exe Token: SeSystemProfilePrivilege 3976 WMIC.exe Token: SeSystemtimePrivilege 3976 WMIC.exe Token: SeProfSingleProcessPrivilege 3976 WMIC.exe Token: SeIncBasePriorityPrivilege 3976 WMIC.exe Token: SeCreatePagefilePrivilege 3976 WMIC.exe Token: SeBackupPrivilege 3976 WMIC.exe Token: SeRestorePrivilege 3976 WMIC.exe Token: SeShutdownPrivilege 3976 WMIC.exe Token: SeDebugPrivilege 3976 WMIC.exe Token: SeSystemEnvironmentPrivilege 3976 WMIC.exe Token: SeRemoteShutdownPrivilege 3976 WMIC.exe Token: SeUndockPrivilege 3976 WMIC.exe Token: SeManageVolumePrivilege 3976 WMIC.exe Token: 33 3976 WMIC.exe Token: 34 3976 WMIC.exe Token: 35 3976 WMIC.exe Token: 36 3976 WMIC.exe Token: SeIncreaseQuotaPrivilege 3976 WMIC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4472 wrote to memory of 2620 4472 dsds.exe 80 PID 4472 wrote to memory of 2620 4472 dsds.exe 80 PID 2620 wrote to memory of 1412 2620 cmd.exe 82 PID 2620 wrote to memory of 1412 2620 cmd.exe 82 PID 4472 wrote to memory of 3832 4472 dsds.exe 84 PID 4472 wrote to memory of 3832 4472 dsds.exe 84 PID 3832 wrote to memory of 3976 3832 cmd.exe 86 PID 3832 wrote to memory of 3976 3832 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\dsds.exe"C:\Users\Admin\AppData\Local\Temp\dsds.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c wmic computersystem get manufacturer,model2⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get manufacturer,model3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c wmic path Win32_Fan get2⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_Fan get3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-