Analysis
- max time kernel
142s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
29/01/2024, 05:52
Behavioral task
behavioral1
Sample
smartscreen_protected.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
General
- Target smartscreen_protected.exe
- Size 2.9MB
- Sample240129-gkrewadaan
- SHA256 c33acab1ddbee95302f0d54feb1c49c40dec807cec251fb6d30d056f571155e0
- MD5 713b1c97b09d0e633ede2f62556e78b9
- SHA1 c67835ca9504049a350fdb023ec7975cccce1674
- SHA512 fadada8a709662a013a5b7984357d41fb004d3e600274ce2d067f081b246a6c8e764e104ff88c2131343d3a500a855ecd5990b968458d0bef5a1e5a15a99ee50
- SSDEEP 49152:f9X3GwWO9gJdmbB6v6WELRkyVVgYgHUByjGw4JGP9zwYFHbXZkigd8ljRs1pit:f9pWO96dEu6WCQUBF1CdyiPsW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects executables packed with Themida 9 IoCs
resource yara_rule behavioral2/memory/4644-0-0x0000000000610000-0x0000000000D86000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4644-2-0x0000000000610000-0x0000000000D86000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4644-3-0x0000000000610000-0x0000000000D86000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4644-4-0x0000000000610000-0x0000000000D86000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4644-5-0x0000000000610000-0x0000000000D86000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4644-6-0x0000000000610000-0x0000000000D86000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4644-7-0x0000000000610000-0x0000000000D86000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4644-8-0x0000000000610000-0x0000000000D86000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4644-1384-0x0000000000610000-0x0000000000D86000-memory.dmp INDICATOR_EXE_Packed_Themida - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ smartscreen_protected.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion smartscreen_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion smartscreen_protected.exe -
resource yara_rule behavioral2/memory/4644-0-0x0000000000610000-0x0000000000D86000-memory.dmp themida behavioral2/memory/4644-2-0x0000000000610000-0x0000000000D86000-memory.dmp themida behavioral2/memory/4644-3-0x0000000000610000-0x0000000000D86000-memory.dmp themida behavioral2/memory/4644-4-0x0000000000610000-0x0000000000D86000-memory.dmp themida behavioral2/memory/4644-5-0x0000000000610000-0x0000000000D86000-memory.dmp themida behavioral2/memory/4644-6-0x0000000000610000-0x0000000000D86000-memory.dmp themida behavioral2/memory/4644-7-0x0000000000610000-0x0000000000D86000-memory.dmp themida behavioral2/memory/4644-8-0x0000000000610000-0x0000000000D86000-memory.dmp themida behavioral2/memory/4644-1384-0x0000000000610000-0x0000000000D86000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA smartscreen_protected.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1815711207-1844170477-3539718864-1000\desktop.ini smartscreen_protected.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1815711207-1844170477-3539718864-1000\desktop.ini smartscreen_protected.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4644 smartscreen_protected.exe - Program crash 1 IoCs
pid pid_target Process procid_target 524 4644 WerFault.exe 18 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe 4644 smartscreen_protected.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\smartscreen_protected.exe"C:\Users\Admin\AppData\Local\Temp\smartscreen_protected.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 8882⤵
- Program crash
PID:524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4644 -ip 46441⤵PID:3084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1815711207-1844170477-3539718864-1000\A
- Size 129B
- SHA256 2c80619d7e7c58257293cda3a878c13e5856f4e06f6f90601276f7b9179c9e07
- MD5 5f54d1240735d46980b776af554f44d3
- SHA1 acf7707c08973ddfdb27cd361442ccfba355c888
- SHA512 b1f542f68a48608ae53904fbe2105bd8f3e544941abb38ec9d24cb7a26f916ef94cfb431cce0c64077dc2934913130d78492914a5e9ffc52f311e68217caef15
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Videos\CBhwKBgQD.README.txt
- Size 575B
- SHA256 cfac38a276ea508da50703915692cb8bd9d734ce74dc051239beb68cf89b2b37
- MD5 61c324611e6b2e1b180664f7a7982a7e
- SHA1 2fd5af80cbe4c805edc71f1d29fd442eabf7109f
- SHA512 7ec1f946f8f659994899c6b8c9b2e6af61d763882dc419e3e18bf98b5884cfdae16e09c27d308ae022df51ec1ed2e3e9b38e970c94c473669f702c33b4876378
- MD5 SHA1 SHA512