Analysis
- max time kernel
141s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
22/04/2024, 02:00
General
- Target fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3.exe
- Size 4.1MB
- Sample240422-ce2lfaeb32
- SHA256 fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3
Malware Config
Signatures
- Modifies firewall policy service 2 TTPs 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 7 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3.exe"C:\Users\Admin\AppData\Local\Temp\fcd465bfb29ad1ee9c3344c27035fe6721f7c634ae714db808454b2d14e6ecd3.exe"1⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gpt.ini
memory/3268-10-0x00007FF800030000-0x00007FF800031000-memory.dmp
memory/3268-11-0x00007FF659830000-0x00007FF65A383000-memory.dmp
memory/3268-9-0x00007FF800000000-0x00007FF800002000-memory.dmp
memory/3268-7-0x00007FF8143B0000-0x00007FF814679000-memory.dmp
memory/3268-8-0x00007FF659830000-0x00007FF65A383000-memory.dmp
memory/3268-0-0x00007FF659830000-0x00007FF65A383000-memory.dmp
memory/3268-12-0x00007FF659830000-0x00007FF65A383000-memory.dmp
memory/3268-6-0x00007FF8143B0000-0x00007FF814679000-memory.dmp
memory/3268-13-0x00007FF659830000-0x00007FF65A383000-memory.dmp
memory/3268-14-0x00007FF816850000-0x00007FF816A45000-memory.dmp
memory/3268-1-0x00007FF659830000-0x00007FF65A383000-memory.dmp
memory/3268-22-0x00007FF659830000-0x00007FF65A383000-memory.dmp
memory/3268-23-0x00007FF8143B0000-0x00007FF814679000-memory.dmp
memory/3268-25-0x00007FF816850000-0x00007FF816A45000-memory.dmp