9a6ae29076f271ff9d607732b48762f12689dd7ab3887d4638a22ab7948b8e32

General

Target

UB Downloads 6.4.24/UB Downloads/Privacy Protector.exe
Size

8.6MB
MD5

fbf038e5ef2e30da99e88371531dfebc
SHA1

b0507491cf241aa4da8b73ef513528b2a937aa2c
SHA256

0890f0b89e5c5745ad4bfaf1ca6459c5b765adae9cc2d0988e9456894350b434
SHA512

2526c6e621b64c861aa5baddd9e80d2bdd5cd7d628be115584e3f0471536ab95ef85be48ae06b5207bc70f9e6eeeb75ceebc2594ebda6b1878cbc22f8321ea84
SSDEEP

196608:gAHP6FQVWZ0C1+eqy/rRXEChq+ZExY37lJo9aM2yf/2dI:KPqWRUChqCtLlW5X2dI

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Privacy Protector.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Privacy Protector.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Privacy Protector.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Privacy Protector.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Privacy Protector.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Privacy Protector.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Privacy Protector.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Privacy Protector.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

Privacy Protector.exe

pid process

1000 Privacy Protector.exe
1000 Privacy Protector.exe
1000 Privacy Protector.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Privacy Protector.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Privacy Protector.exe

pid	process
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe
1000	Privacy Protector.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

Privacy Protector.execmd.exe

description	pid	process	target process
PID 1000 wrote to memory of 1236	1000	Privacy Protector.exe	cmd.exe
PID 1000 wrote to memory of 1236	1000	Privacy Protector.exe	cmd.exe
PID 1236 wrote to memory of 1152	1236	cmd.exe	certutil.exe
PID 1236 wrote to memory of 1152	1236	cmd.exe	certutil.exe
PID 1236 wrote to memory of 2304	1236	cmd.exe	find.exe
PID 1236 wrote to memory of 2304	1236	cmd.exe	find.exe
PID 1236 wrote to memory of 1984	1236	cmd.exe	find.exe
PID 1236 wrote to memory of 1984	1236	cmd.exe	find.exe
PID 1000 wrote to memory of 980	1000	Privacy Protector.exe	cmd.exe
PID 1000 wrote to memory of 980	1000	Privacy Protector.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\UB Downloads 6.4.24\UB Downloads\Privacy Protector.exe
"C:\Users\Admin\AppData\Local\Temp\UB Downloads 6.4.24\UB Downloads\Privacy Protector.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\UB Downloads 6.4.24\UB Downloads\Privacy Protector.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\UB Downloads 6.4.24\UB Downloads\Privacy Protector.exe" MD5
3⤵
PID:1152

C:\Windows\system32\find.exe
find /i /v "md5"
3⤵
PID:2304

C:\Windows\system32\find.exe
find /i /v "certutil"
3⤵
PID:1984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Color 05
2⤵
PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-0-0x00007FFC98E50000-0x00007FFC99099000-memory.dmp

Filesize
2.3MB

Download
memory/1000-2-0x00007FFC9A010000-0x00007FFC9A0BE000-memory.dmp

Filesize
696KB

Download
memory/1000-3-0x00007FFC9A010000-0x00007FFC9A0BE000-memory.dmp

Filesize
696KB

Download
memory/1000-1-0x00007FFC9A010000-0x00007FFC9A0BE000-memory.dmp

Filesize
696KB

Download
memory/1000-5-0x00007FFC80000000-0x00007FFC80002000-memory.dmp

Filesize
8KB

Download
memory/1000-6-0x0000000180000000-0x000000018001A000-memory.dmp

Filesize
104KB

Download
memory/1000-13-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/1000-16-0x0000000002050000-0x00000000020D1000-memory.dmp

Filesize
516KB

Download
memory/1000-22-0x00007FFC9C5D0000-0x00007FFC9C7AB000-memory.dmp

Filesize
1.9MB

Download
memory/1000-23-0x00007FFC80030000-0x00007FFC80031000-memory.dmp

Filesize
4KB

Download
memory/1000-27-0x00007FFC98E50000-0x00007FFC99099000-memory.dmp

Filesize
2.3MB

Download
memory/1000-28-0x00007FFC9A010000-0x00007FFC9A0BE000-memory.dmp

Filesize
696KB

Download
memory/1000-30-0x00007FFC9C5D0000-0x00007FFC9C7AB000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads