Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
12/02/2024, 20:19
Behavioral task
behavioral1
Sample
hahahahahahahahahahahahah/cheeto.exe
Resource
win10-20231215-en
windows10-1703-x64
14 signatures
150 seconds
General
-
Target
hahahahahahahahahahahahah/cheeto.exe
-
Size
4.0MB
-
MD5
d8a87de9f5f0a65be7aca6a2fad43850
-
SHA1
7dedd4726434e83118cce9bed022a9b69b2e3597
-
SHA256
a38bae826b70c938950a3686070282a22d8cceedb47374b4eeeaa45b2443d1c6
-
SHA512
f3b00b4c08d6690c38557746a873e7185be53fb18f8b6cff78e157b9090a4fe86e8428229d36f88e513c8b5139957486f198ff1b21b81c8311bc0fab46e1dd22
-
SSDEEP
98304:4vYC9j4fMjwI9P8FgQnPvmb/9M+bshSqZORpkcNZfGafu:4w9fMvEF5nWq+wh2k+s2u
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cheeto.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\frAQBc8Wsa1xVPfv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\frAQBc8Wsa1xVPfv" cheeto.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cheeto.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cheeto.exe -
resource yara_rule behavioral1/memory/3520-0-0x00007FF6D2D80000-0x00007FF6D381F000-memory.dmp themida behavioral1/memory/3520-2-0x00007FF6D2D80000-0x00007FF6D381F000-memory.dmp themida behavioral1/memory/3520-3-0x00007FF6D2D80000-0x00007FF6D381F000-memory.dmp themida behavioral1/memory/3520-4-0x00007FF6D2D80000-0x00007FF6D381F000-memory.dmp themida behavioral1/memory/3520-5-0x00007FF6D2D80000-0x00007FF6D381F000-memory.dmp themida behavioral1/memory/3520-6-0x00007FF6D2D80000-0x00007FF6D381F000-memory.dmp themida behavioral1/memory/3520-7-0x00007FF6D2D80000-0x00007FF6D381F000-memory.dmp themida behavioral1/memory/3520-8-0x00007FF6D2D80000-0x00007FF6D381F000-memory.dmp themida behavioral1/memory/3520-17-0x00007FF6D2D80000-0x00007FF6D381F000-memory.dmp themida behavioral1/memory/3520-18-0x00007FF6D2D80000-0x00007FF6D381F000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cheeto.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3520 cheeto.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 3520 cheeto.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeLoadDriverPrivilege 3520 cheeto.exe Token: SeDebugPrivilege 1208 taskmgr.exe Token: SeSystemProfilePrivilege 1208 taskmgr.exe Token: SeCreateGlobalPrivilege 1208 taskmgr.exe Token: 33 1208 taskmgr.exe Token: SeIncBasePriorityPrivilege 1208 taskmgr.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe 1208 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3520 wrote to memory of 3584 3520 cheeto.exe 73 PID 3520 wrote to memory of 3584 3520 cheeto.exe 73 PID 3584 wrote to memory of 3376 3584 cmd.exe 75 PID 3584 wrote to memory of 3376 3584 cmd.exe 75 PID 3584 wrote to memory of 2148 3584 cmd.exe 77 PID 3584 wrote to memory of 2148 3584 cmd.exe 77 PID 3584 wrote to memory of 2184 3584 cmd.exe 76 PID 3584 wrote to memory of 2184 3584 cmd.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\hahahahahahahahahahahahah\cheeto.exe"C:\Users\Admin\AppData\Local\Temp\hahahahahahahahahahahahah\cheeto.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\hahahahahahahahahahahahah\cheeto.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\hahahahahahahahahahahahah\cheeto.exe" MD53⤵PID:3376
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:2184
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2148
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1208