Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
12-02-2024 20:20
Behavioral task
behavioral1
Sample
hahahahahahahahahahahahah/cheeto.exe
Resource
win10-20231215-en
General
-
Target
hahahahahahahahahahahahah/cheeto.exe
-
Size
4.0MB
-
MD5
d8a87de9f5f0a65be7aca6a2fad43850
-
SHA1
7dedd4726434e83118cce9bed022a9b69b2e3597
-
SHA256
a38bae826b70c938950a3686070282a22d8cceedb47374b4eeeaa45b2443d1c6
-
SHA512
f3b00b4c08d6690c38557746a873e7185be53fb18f8b6cff78e157b9090a4fe86e8428229d36f88e513c8b5139957486f198ff1b21b81c8311bc0fab46e1dd22
-
SSDEEP
98304:4vYC9j4fMjwI9P8FgQnPvmb/9M+bshSqZORpkcNZfGafu:4w9fMvEF5nWq+wh2k+s2u
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
cheeto.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cheeto.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
cheeto.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\frAQBc8Wsa1xVPfv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\frAQBc8Wsa1xVPfv" cheeto.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
cheeto.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cheeto.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cheeto.exe -
Processes:
resource yara_rule behavioral1/memory/3620-0-0x00007FF6B9F60000-0x00007FF6BA9FF000-memory.dmp themida behavioral1/memory/3620-2-0x00007FF6B9F60000-0x00007FF6BA9FF000-memory.dmp themida behavioral1/memory/3620-3-0x00007FF6B9F60000-0x00007FF6BA9FF000-memory.dmp themida behavioral1/memory/3620-4-0x00007FF6B9F60000-0x00007FF6BA9FF000-memory.dmp themida behavioral1/memory/3620-10-0x00007FF6B9F60000-0x00007FF6BA9FF000-memory.dmp themida behavioral1/memory/3620-11-0x00007FF6B9F60000-0x00007FF6BA9FF000-memory.dmp themida behavioral1/memory/3620-12-0x00007FF6B9F60000-0x00007FF6BA9FF000-memory.dmp themida behavioral1/memory/3620-13-0x00007FF6B9F60000-0x00007FF6BA9FF000-memory.dmp themida behavioral1/memory/3620-22-0x00007FF6B9F60000-0x00007FF6BA9FF000-memory.dmp themida behavioral1/memory/3620-26-0x00007FF6B9F60000-0x00007FF6BA9FF000-memory.dmp themida -
Processes:
cheeto.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cheeto.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
cheeto.exepid process 3620 cheeto.exe -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1836 taskmgr.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
cheeto.exepid process 3620 cheeto.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
taskmgr.execheeto.exedescription pid process Token: SeDebugPrivilege 1836 taskmgr.exe Token: SeSystemProfilePrivilege 1836 taskmgr.exe Token: SeCreateGlobalPrivilege 1836 taskmgr.exe Token: SeLoadDriverPrivilege 3620 cheeto.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe 1836 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cheeto.execmd.exedescription pid process target process PID 3620 wrote to memory of 500 3620 cheeto.exe cmd.exe PID 3620 wrote to memory of 500 3620 cheeto.exe cmd.exe PID 500 wrote to memory of 4628 500 cmd.exe certutil.exe PID 500 wrote to memory of 4628 500 cmd.exe certutil.exe PID 500 wrote to memory of 2748 500 cmd.exe find.exe PID 500 wrote to memory of 2748 500 cmd.exe find.exe PID 500 wrote to memory of 3516 500 cmd.exe find.exe PID 500 wrote to memory of 3516 500 cmd.exe find.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hahahahahahahahahahahahah\cheeto.exe"C:\Users\Admin\AppData\Local\Temp\hahahahahahahahahahahahah\cheeto.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\hahahahahahahahahahahahah\cheeto.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\hahahahahahahahahahahahah\cheeto.exe" MD53⤵PID:4628
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2748
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:3516
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1836