Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
24/04/2024, 02:00
General
- Target d393c369fcce5b961018081cd6b15105eed1cc2a74ff235beb5439be050393dc.exe
- Size 379KB
- Sample240424-cezf3seb35
- SHA256 d393c369fcce5b961018081cd6b15105eed1cc2a74ff235beb5439be050393dc
Malware Config
Signatures
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 16 IoCs
- Modifies firewall policy service 2 TTPs 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 7 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 6 IoCs
- Executes dropped EXE 23 IoCs
- Loads dropped DLL 11 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 8 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- Drops file in System32 directory 14 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Windows directory 6 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 4 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d393c369fcce5b961018081cd6b15105eed1cc2a74ff235beb5439be050393dc.exe"C:\Users\Admin\AppData\Local\Temp\d393c369fcce5b961018081cd6b15105eed1cc2a74ff235beb5439be050393dc.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d393c369fcce5b961018081cd6b15105eed1cc2a74ff235beb5439be050393dc.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\VJ7590zfXTInKvE7b5PUZ2ew.exe"C:\Users\Admin\Pictures\VJ7590zfXTInKvE7b5PUZ2ew.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\VJ7590zfXTInKvE7b5PUZ2ew.exe"C:\Users\Admin\Pictures\VJ7590zfXTInKvE7b5PUZ2ew.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Pictures\dTjL41iGO9iGwUDuQfRXyms8.exe"C:\Users\Admin\Pictures\dTjL41iGO9iGwUDuQfRXyms8.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u18k.0.exe"C:\Users\Admin\AppData\Local\Temp\u18k.0.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 10205⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\driverRemote_debug\UniversalInstaller.exeC:\Users\Admin\AppData\Local\Temp\driverRemote_debug\UniversalInstaller.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\driverRemote_debug\UniversalInstaller.exeC:\Users\Admin\AppData\Roaming\driverRemote_debug\UniversalInstaller.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe8⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u18k.1.exe"C:\Users\Admin\AppData\Local\Temp\u18k.1.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 15044⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\6ev9Beuie2LMEhgF0Hm9xeBt.exe"C:\Users\Admin\Pictures\6ev9Beuie2LMEhgF0Hm9xeBt.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\6ev9Beuie2LMEhgF0Hm9xeBt.exe"C:\Users\Admin\Pictures\6ev9Beuie2LMEhgF0Hm9xeBt.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 7725⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 8684⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\RfJe5HDL8bV1HlapW32MyErH.exe"C:\Users\Admin\Pictures\RfJe5HDL8bV1HlapW32MyErH.exe" --silent --allusers=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
-
C:\Users\Admin\Pictures\RfJe5HDL8bV1HlapW32MyErH.exeC:\Users\Admin\Pictures\RfJe5HDL8bV1HlapW32MyErH.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.59 --initial-client-data=0x290,0x280,0x2b0,0x294,0x2b4,0x6f34e1d0,0x6f34e1dc,0x6f34e1e84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\RfJe5HDL8bV1HlapW32MyErH.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\RfJe5HDL8bV1HlapW32MyErH.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Pictures\RfJe5HDL8bV1HlapW32MyErH.exe"C:\Users\Admin\Pictures\RfJe5HDL8bV1HlapW32MyErH.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3900 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240424020037" --session-guid=d72e531b-8703-4982-a59d-a9fdafa131e3 --server-tracking-blob="Yzg3NjY2MDBmY2RjNTg1M2I4MGQxZjMzZTQ0Yzc4OGNiNmQ0NjU4ZDEzNjZmN2ExMTFlZTY1ZGU4ZTVjYTU5OTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fMTIzIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzOTI0MDEwLjQwODUiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzEyMyIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiNzU0YTQ1NDEtYTZjYS00NWMwLWFlZTItOGY3YmQxNGE0OTQ3In0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=A4050000000000004⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
-
C:\Users\Admin\Pictures\RfJe5HDL8bV1HlapW32MyErH.exeC:\Users\Admin\Pictures\RfJe5HDL8bV1HlapW32MyErH.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.59 --initial-client-data=0x2b8,0x2bc,0x2c0,0x2b4,0x2c4,0x6e0de1d0,0x6e0de1dc,0x6e0de1e85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404240200371\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404240200371\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404240200371\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404240200371\assistant\assistant_installer.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404240200371\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404240200371\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x756038,0x756044,0x7560505⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\Pictures\XgN2QsulSbBm0KOaJt39W7GE.exe"C:\Users\Admin\Pictures\XgN2QsulSbBm0KOaJt39W7GE.exe"3⤵
- Modifies firewall policy service
- Windows security bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1144 -ip 11441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 768 -ip 7681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4624 -ip 46241⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1604 -ip 16041⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-Interactive
additional_file0.tmp
assistant_installer.exe
dbgcore.DLL
dbghelp.dll
opera_package
Opera_installer_2404240200374603900.dll
Qg_Appv5.exe
__PSScriptPolicyTest_eiwd3n2v.2i5.ps1
injector.exe
UIxMarketPlugin.dll
UniversalInstaller.exe
groupware.wav
macrospore.indd
relay.dll
f9f12a24
fc65cd3
tmpEB38.tmp
tmpEB79.tmp
u18k.0.exe
u18k.1.exe
settings.dat
RfJe5HDL8bV1HlapW32MyErH.exe
VJ7590zfXTInKvE7b5PUZ2ew.exe
XgN2QsulSbBm0KOaJt39W7GE.exe
dTjL41iGO9iGwUDuQfRXyms8.exe
rnAT4b2lmdt5AvxaXkkGeP1a.exe
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
gpt.ini
windefender.exe
memory/768-72-0x0000000004870000-0x0000000004C75000-memory.dmp
memory/768-175-0x0000000000400000-0x0000000004427000-memory.dmp
memory/1144-166-0x0000000000400000-0x0000000004044000-memory.dmp
memory/1144-153-0x00000000041C0000-0x00000000041E7000-memory.dmp
memory/1144-152-0x00000000042B0000-0x00000000043B0000-memory.dmp
memory/1180-171-0x0000000000400000-0x0000000004427000-memory.dmp
memory/1180-71-0x0000000006510000-0x0000000006DFB000-memory.dmp
memory/1180-70-0x0000000004970000-0x0000000004D6C000-memory.dmp
memory/1604-150-0x0000000004140000-0x0000000004240000-memory.dmp
memory/1604-593-0x0000000000400000-0x0000000004067000-memory.dmp
memory/1604-718-0x0000000000400000-0x0000000004067000-memory.dmp
memory/1604-250-0x0000000000400000-0x0000000004067000-memory.dmp
memory/1604-64-0x0000000004140000-0x0000000004240000-memory.dmp
memory/1604-66-0x00000000043E0000-0x000000000444E000-memory.dmp
memory/1924-107-0x0000000007070000-0x000000000708A000-memory.dmp
memory/1924-83-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/1924-126-0x000000006F140000-0x000000006F494000-memory.dmp
memory/1924-106-0x0000000006FD0000-0x0000000007046000-memory.dmp
memory/1924-149-0x0000000007430000-0x00000000074C6000-memory.dmp
memory/1924-105-0x0000000006200000-0x0000000006244000-memory.dmp
memory/1924-115-0x000000006F670000-0x000000006F6BC000-memory.dmp
memory/1924-104-0x0000000005CE0000-0x0000000005D2C000-memory.dmp
memory/1924-145-0x0000000007370000-0x000000000737A000-memory.dmp
memory/1924-80-0x0000000004D60000-0x0000000004DC6000-memory.dmp
memory/1924-82-0x0000000004880000-0x0000000004890000-memory.dmp
memory/1924-156-0x00000000073E0000-0x00000000073F4000-memory.dmp
memory/1924-158-0x0000000007410000-0x0000000007418000-memory.dmp
memory/1924-144-0x0000000004880000-0x0000000004890000-memory.dmp
memory/1924-78-0x0000000004880000-0x0000000004890000-memory.dmp
memory/1924-74-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/1924-112-0x000000007FBC0000-0x000000007FBD0000-memory.dmp
memory/1924-165-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/1924-137-0x0000000007280000-0x0000000007323000-memory.dmp
memory/2304-176-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/2460-19-0x0000000005620000-0x0000000005630000-memory.dmp
memory/2460-18-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/2460-141-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/2460-4-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2460-151-0x0000000005620000-0x0000000005630000-memory.dmp
memory/2540-589-0x000000006D550000-0x000000006D6CB000-memory.dmp
memory/2540-583-0x0000000000400000-0x0000000000C2C000-memory.dmp
memory/2540-643-0x000000006D550000-0x000000006D6CB000-memory.dmp
memory/2540-592-0x000000006D550000-0x000000006D6CB000-memory.dmp
memory/2540-590-0x00007FFD80C90000-0x00007FFD80E85000-memory.dmp
memory/2580-634-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/2768-694-0x000000006D550000-0x000000006D6CB000-memory.dmp
memory/2768-684-0x00007FFD80C90000-0x00007FFD80E85000-memory.dmp
memory/2876-17-0x000002BBAA690000-0x000002BBAA6A0000-memory.dmp
memory/2876-5-0x00007FFD62C40000-0x00007FFD63701000-memory.dmp
memory/2876-12-0x000002BBAA690000-0x000002BBAA6A0000-memory.dmp
memory/2876-11-0x000002BBAA5B0000-0x000002BBAA5D2000-memory.dmp
memory/2876-22-0x00007FFD62C40000-0x00007FFD63701000-memory.dmp
memory/2912-0-0x0000027787550000-0x0000027787558000-memory.dmp
memory/2912-1-0x00007FFD62C40000-0x00007FFD63701000-memory.dmp
memory/2912-3-0x00000277891E0000-0x000002778923E000-memory.dmp
memory/2912-2-0x0000027789360000-0x0000027789370000-memory.dmp
memory/2912-23-0x00007FFD62C40000-0x00007FFD63701000-memory.dmp
memory/3504-79-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/3504-73-0x0000000005060000-0x0000000005096000-memory.dmp
memory/3504-154-0x0000000007D10000-0x0000000007D21000-memory.dmp
memory/3504-110-0x0000000007BA0000-0x0000000007BD2000-memory.dmp
memory/3504-143-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/3504-111-0x000000007F220000-0x000000007F230000-memory.dmp
memory/3504-114-0x000000006F140000-0x000000006F494000-memory.dmp
memory/3504-125-0x0000000007BE0000-0x0000000007BFE000-memory.dmp
memory/3504-77-0x0000000005550000-0x0000000005572000-memory.dmp
memory/3504-113-0x000000006F670000-0x000000006F6BC000-memory.dmp
memory/3504-75-0x00000000057D0000-0x0000000005DF8000-memory.dmp
memory/3504-81-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/3504-108-0x0000000008050000-0x00000000086CA000-memory.dmp
memory/3504-157-0x0000000007E50000-0x0000000007E6A000-memory.dmp
memory/3504-103-0x0000000006620000-0x000000000663E000-memory.dmp
memory/3504-155-0x0000000007D50000-0x0000000007D5E000-memory.dmp
memory/3504-76-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/3504-164-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/3504-102-0x00000000061F0000-0x0000000006544000-memory.dmp
memory/3756-616-0x00007FFD80C90000-0x00007FFD80E85000-memory.dmp
memory/3756-613-0x000000006D550000-0x000000006D6CB000-memory.dmp
memory/4344-637-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4344-691-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4344-687-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4344-569-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4344-707-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4344-547-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4344-432-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4344-508-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4344-757-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4520-550-0x00007FF720B00000-0x00007FF721245000-memory.dmp
memory/4520-552-0x00007FF720B00000-0x00007FF721245000-memory.dmp
memory/4520-549-0x00007FF720B00000-0x00007FF721245000-memory.dmp
memory/4520-558-0x00007FF720B00000-0x00007FF721245000-memory.dmp
memory/4520-557-0x00007FF720B00000-0x00007FF721245000-memory.dmp
memory/4520-555-0x00007FF720B00000-0x00007FF721245000-memory.dmp
memory/4520-559-0x00007FF720B00000-0x00007FF721245000-memory.dmp
memory/4520-570-0x00007FF720B00000-0x00007FF721245000-memory.dmp
memory/4520-548-0x00007FF720B00000-0x00007FF721245000-memory.dmp
memory/4624-173-0x0000000006510000-0x0000000006DFB000-memory.dmp
memory/4624-352-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4624-172-0x0000000004970000-0x0000000004D6F000-memory.dmp
memory/4884-631-0x000000006D550000-0x000000006D6CB000-memory.dmp
memory/4884-645-0x000000006D550000-0x000000006D6CB000-memory.dmp
memory/4884-635-0x00007FFD80C90000-0x00007FFD80E85000-memory.dmp
memory/4940-174-0x00000000048F0000-0x0000000004CF0000-memory.dmp
memory/4940-350-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4940-371-0x0000000000400000-0x0000000004427000-memory.dmp
memory/4956-696-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/4956-686-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/5096-708-0x000000006BE10000-0x000000006D064000-memory.dmp